1

I have a systemd based system and for some services I had to set up remote logging. The simplest way to set this was to use rsyslog and set the StandardOutput=syslog in the unit file.

Now I also need the boot messages and kernel logs remotely logged, but can't locate a unit file representing the kernel where I would put StandardOutput=syslog.

Any ideas on how to approach that?

1

Systemd uses journald to do logging. It is configured in /etc/systemd/journald.conf. See man journald.conf. In particular you can create the file /etc/systemd/journald.conf.d/my.conf with the contents

ForwardToSyslog=on

to have all logging sent to socket /run/systemd/journal/syslog. Normally, syslog is configured in /etc/rsyslog.conf to read this socket by having at its start the line

$ModLoad imjournal # provides access to the systemd journal

You can use the usual syslog filtering on this data stream.

2
  • Hey, was asking on the peculiarities on setting the kernel logging in journald and how it differs from setting logging for a system service (because the kernel can't really have a unit file). – TheMeaningfulEngineer Mar 15 '19 at 15:37
  • Note, if you want to get the messages from the kernel as they are printed on the console, you can have the kernel send them over udp using the netconsole boot option. If I remember correctly, systemd recovers the dmesg logs from kernel memory as soon as it can, and puts them in a ramfs file, until a real file is available. The kernel only outputs to the console and the dmesg in-memory log. – meuh Mar 15 '19 at 18:11
0

Getting the logs from the kernel needs a different approach than getting the logs from a service.

Kernel stores it's logs in memory in a structure called the kernel ring buffer. This is exposed to userspace through a special file /dev/kmsg. By default journald will read that file. So if journald is forwarding everything to rsyslog it will forward the kernel messages too.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.