I have a configuration in which journald is set with
ForwardToSyslog=yes. Quote from the documentation:
If forwarding to syslog is enabled but nothing reads messages from the socket, forwarding to syslog has no effect.
I am experiencing a different observation with the following test:
systemctl disable rsyslog systemctl stop rsyslog logger "rsyslog is dropped, journald won't forward this message" systemctl enable rsyslog systemctl start rsyslog # This shouldn't find anything grep "rsyslog is dropped" /var/log/syslog Mar 15 16:26:23 hostname user: rsyslog is dropped, journald won't forward this message
The result is that rsyslog manages to end up processing the message.
rsyslog has been set without the capability to read the journal database.
My assumption is that socket buffering capabilities are causing rsyslog receive before the time it is running.
If that is the case is it possible to remove this buffering of at least force flushing the socket from bash somehow so rsyslogs history starts together with it?