When a process fork()
s children without closing and reopening standard IO, all children share the same IO file descriptors.
By default, running such forking process in a systemd unit will result in any standard output being written to the journal, as expected.
On systemd 241 (Debian buster, Linux 4.19) these journal entries have a _PID
field matching the PID of the parent process (the one that systemd started), no matter what process actually wrote to stdout (or stderr).
However... on systemd 247 (Debian bullseye, Linux 5.9) the journal _PID
entry correctly matches the PID of the process who actually wrote to the shared stdout file descriptor. I am guessing it does this by reading some magic flags on the socket receive logic, which is awesome.
I have read through the systemd changelog and I can't understand at what point this changed and how, or if something is just configured differently.
Is there a way to have matching _PID tags on the journal for the systemd and Linux kernel shipped with buster?