1

To my understanding systemd-journald creates a couple sockets, where it posts its logging events.

# systemctl cat systemd-journald.socket | egrep -v '^ *#'

[Unit]
Description=Journal Socket
Documentation=man:systemd-journald.service(8) man:journald.conf(5)
DefaultDependencies=no
Before=sockets.target

IgnoreOnIsolate=yes

[Socket]
ListenStream=/run/systemd/journal/stdout
ListenDatagram=/run/systemd/journal/socket
SocketMode=0666
PassCredentials=yes
PassSecurity=yes
ReceiveBuffer=8M
Service=systemd-journald.service

So how can I read these events? I tried:

# netcat -U /run/systemd/journal/stdout
# echo $?
0
# netcat -uU /run/systemd/journal/socket

netcat immediately disconnect from the stdout (exit status is clean). netcat connect to the socket, but does not register any events - I can confirm this with the command journalctl -f -n0 which does show stuff going on, while socket output is empty.

  • Why do you specifically need to use the socket? Doesn't journalctl -f suffice? – Raman Sailopal Oct 25 '17 at 10:58
  • Just trying to understand what info traverse the sockets and if syslog-ng utility shave off anything when it reads from them. – NarūnasK Oct 25 '17 at 11:11
  • You have completely the wrong end of the stick. These are not the sockets that syslog programs read from. See unix.stackexchange.com/a/294206/5132 and unix.stackexchange.com/questions/362681 for starters. This question has a quite erroneous premise, so is not really answerable. – JdeBP Oct 25 '17 at 13:30
  • @JdeBP Can you elaborate more? In your own post you state '/run/systemd/journal/syslog' it writes journal data there. I just tried netcat -uU /run/systemd/journal/syslog which yielded no results either. FYI I have Alias=syslog.service in my syslog-ng.service which to my understanding activates /run/systemd/journal/syslog. – NarūnasK Oct 25 '17 at 14:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.