TL;DR: It's GNOME Shell that decided to do that. They run multiple applications (applets) inside the same process, so they decided to use the XDG menu specifications as the "tag" to attach to the messages.
Full explanation below...
So the journal synthesizes the syslog-like message that you see from the internal fields stored with each message. (You can see the internal fields by using the
-o verbose format.)
The field that usually carries the program name, a.k.a. the "tag", is stored in the SYSLOG_IDENTIFIER field.
(Other programs make use of the SYSLOG_IDENTIFIER. For instance,
logger will by default send the tag from the user who's calling it and you can override it using the
There are 3 main ways to log to the journal, either by using the traditional syslog(3) interface, by writing to stdout or stderr from a systemd service, or by using the native journal interface.
GNOME Shell uses the native journal interface, in particular, the sd_journal_stream_fd API. That function takes an identifier as first argument, which is then used as SYSLOG_IDENTIFIER of messages sent through that stream.
The GNOME Shell code that initializes the journald stream can be found in src/shell-app.c, and tracing back the used
appid to the caller shows that it is set using g_app_info_get_id.
Looking up g_app_info_get_id, you'll see that the ID is platform-specific, but "on Unix this is the desktop file id from the xdg menu specification", which matches what you're observing.
The code in src/shell-app.c is preceded by a comment that explains the rationale:
/* This sets up the launched application to log to the journal
* using its own identifier, instead of just "gnome-session".
In other words, GNOME Shell runs multiple applications (through applets), so GNOME Shell developers thought it would be more appropriate to use the XDG menu specifications in the log messages, so you could tell which applet is generating it...
These logging streams may also be inherited by any child processes, such as Xwayland. In this case, the PID following the tag appears to refer to gnome-shell, the process that opened the stream_fd, and not the child process which writes the message to the fd. The log message below shows a crash of the Xwayland server, but the PID 3493 is that of gnome-shell, not Xwayland.
Mar 17 18:08:39 alan-laptop org.gnome.Shell.desktop: (EE) Caught signal 7 (Bus error). Server aborting