How to use systemd kernel argument systemd.journald.forward_to_syslog

Question

I like to provision several machines via PXE, and pass the kernel argument systemd.journald.forward_to_syslog to all machine, so I can monitor all the logs from a central place. (I can't change the machine config, this is the first boot, and only boot)

From the docs it seems like this option is a boolean true/false option, but I was not able to find how to set the detestation for the syslog server. I also tried to use it like this systemd.journald.forward_to_syslog=1.2.3.4 , but I don't see and traffic generated to my syslog server.

Have any one tried it before ?

Answer 1

Systemd-journald does not support sending messages over the network. This option controls forwarding to a local syslog daemon, which is expected to listen at /run/systemd/journal/syslog.

(However, this is not the recommended method anyway. When using either syslog-ng or rsyslogd, it is more reliable to let the syslog daemon pull the journal messages by directly reading the .journal files, while keeping the "forward" option disabled. This allows syslogd to accurately preserve all metadata fields that go beyond the standard BSD Syslog format.)

In short: you will need to install an actual syslog daemon, configure it to read .journal files (using the system() source in syslog-ng or the imjournal module in rsyslogd), and tell it to forward the imported messages over the network.

Answer 2

After searching about this matter more, seem like systemd.journald.forward_to_syslog is not the right way to tackle this.

Also found this answer by systemd creator Lennart Poettering

Doing this inside of journald is not pretty as journald is started long before the network is up, and would mean we'd have to turn off the sandbox it is living in. By doing this in a separate mini daemon instead, we gain asynchronous behavior (i.e. as soon as netlogd starts it can "catch up" with what happened in the meantime), and journald doesn't need to be network facing.

and the recommended way is to use netlogd (which not seems to be per-compiled with CentOS/Fedora machines 😞)