For a while looking for a solution that with systemd tools will give me an opportunity to bypass the journal and log directly to syslog. Potentially that can be also filtered, but only on journal not on syslog of course.

So far I can't make it right. My system is OL8 with systemd 239-68.

What was already tried:


This gives dual logging to journal and to syslog. Second try was set StandardOutput and StandardError to append.

Do not want to use above, since messages sent that way are raw with no identifier or timestamp that probably needs to be set by the sender (application) and this is out of my jurisdiction.

I know that I can do it using ExecStart and 2>&1 with logger in separate script but really it is last resort since it is informal.

Also saw these two topics:



But none of them address specifically the above problem.

Can you point me to any other ideas on how to solve this problem?

  • According to this Answer, add directives with file path syntax like StandardOutput=file:/home/user/log1.log, or StandardOutput=append:/home/user/log1.log. Feb 25, 2023 at 3:45
  • @JamesThomasMoon Please read my question again. You will notice that append is covered there and why I would not like to use it.
    – jareeq
    Feb 25, 2023 at 22:53
  • You tried StandardOutput=syslog for syslog. The recommend syntax for is StandardOutput=file:/home/user/log1.log. Feb 26, 2023 at 5:12
  • ... so I will explain again - append is useless considering my needs - it depends on application raw output so there is no timestamp and application identifier. That's why I want to go with syslog. Proposed file is similar to append , second one will not delete content of log between service restarts. Anyway - both append and file need scripting inside ExecStart or application output change. That is why I do not want to go with it. I will modify my question to point it clearly.
    – jareeq
    Feb 26, 2023 at 9:10

1 Answer 1


One possibility is to connect the stdout of the program to a Unix domain socket. Configure rsyslogd to read this socket, and to add a timestamp before doing any filtering and eventually writing it to a file. For example, add these lines to /etc/rsyslog.conf:

input(type="imptcp" path="/tmp/mysocket1" name="my1")
template(name="outfmt" type="string" string="%timegenerated:::date-rfc3339% %inputname% %rawmsg%\n")
if $inputname=="my1" then {
  action(type="omfile" file="myoutput" template="outfmt")

When rsyslogd is restarted it will create a socket /tmp/mysocket1. In the systemd service file use


By default, StandardError inherits the same socket as StandardOutput.

Now all the lines written by the program will be read by rsyslogd and can be handled, for example by adding the time received timestamp, the name "my1" we gave to the input, and the rawmsg. (The rsyslog documentation suggests that systemd actually ignores the timestamp in a message anyway, and uses its own internal time, so this is not unusual).

If you need to distinguish between several programs, they would each need to have their own named socket. Instead of testing the inputname, it might be preferable to enclose the setup in a ruleset. Of course, you can also create and run a separate dedicated rsyslogd daemon with its own config file.

  • 1
    This is what I need, have only one service to log that way so it is not complicated and fits my need for minimal shell scripting. Meanwhile found that with systemd > 245 I can Also use different, dedicated namespace configured with minimal space redirecting logs from service using LogNamespace directive.
    – jareeq
    Feb 26, 2023 at 20:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .