I wonder if systemd-journald is a new implementation of syslog protocol, or rather, it uses syslog implementations, such as rsyslog, syslog-ng
I've googled a bit, but I didn't find nothing convincing about it.
As far as protocols are concerned,
/run/systemd/journal/stdout. systemd connects the raw standard outputs and errors of services (that have defaulted to or that explicitly have
StandardError=journal) to this socket. It thus receives the protocol of variable length free-format records terminated with linefeeds.
/run/systemd/journal/dev-log, which is symbolically linked from
/dev/log. This receives the protocol that the
syslog() library function in the GNU C library, linked into applications, speaks.
/run/systemd/journal/syslog. This also receives the protocol that the
syslog() library function in the GNU C library speaks (although
systemd-journald actually uses another library and another function to speak it).
/dev/kmsg. This receives the protocol that the Linux kernel speaks, which is a protocol of variable length, largely free-format, records terminated with linefeeds.
/run/systemd/journal/socket. This is analogous to the GNU C library case in that applications link to a library that speaks a certain protocol to this socket; except that the function is
sd_journal_sendv(), it is in a systemd C library that applications link to, and the protocol is not standardized but is a systemd-only protocol comprising an array of key=value pairs, and optionally a readable file descriptor, in each datagram.
The protocol spoken by the
syslog() function in the GNU C library is neither RFC 5424 nor RFC 3164, and is effectively its own de facto standard. It isn't RFC 5424 because it does not have the correct amount of whitespace and the dashes designating optional fields with NIL values. It is not RFC 3164 because it has a
PROCID field instead of a
A couple of years ago, your systemd operating system would have had:
systemd-journald doing all of the above (and some things which are irrelevant when it comes to protocols) and being the server that the GNU C library and the systemd C library talk to using their respective protocols
inetd-style when something attempts to send messages to
/run/systemd/journal/syslog and receiving the socket as an open file descriptor, or as a straight service configured to open and listen on
/run/systemd/journal/syslog with its (equivalent of the rsyslog)
imuxsock module; and speaking the GNU C library protocol
Nowadays, your systemd operating system has:
systemd-journald again doing all of the above and being the server that the GNU C library and the systemd C library talk to