28

I'm feeling like I've overlooked the obvious, but I can't figure out how to get my Arch Linux server, which uses systemd, to receive and log syslog messages from a remote system.

I have a Cisco 678 DSL modem and a DD-WRT WAP, and both can be configured to send syslog-format messages to some other machine. I'd like that machine to be my Arch Linux server.

I've googled around, and all I find is that "systemd replaces syslog", or that I no longer need to run syslog or something equally irrelevant to my question.

UPDATE

I have asked on the Arch forums and gotten no relevant answers. I've installed syslog-ng just to listen on UDP port 514. syslog-ng writes messages from my Cisco 678, and a DD-WRT WAP I've got. Unfortunately, the messages don't end up in systemd's journal, but rather in flat files. So, no exact solution, but something of a workaround. I'd rather have the syslog messages in the journal, not in flat files.

Improve this question
1
  • systemd uses its own log. There's also metalog, which is available in the core Arch repos--I, personally, use all three: syslog, systemd's journal, and metalog. Try checking the systemd journal. If I recall correctly, syslog, ever since the switch to systemd, has been configured to send all of its messages and such to systemd's journal.
    – Alexej Magura
    Jul 30, 2013 at 19:58

6 Answers 6

Reset to default
12

You can write a poor man's syslog server quite easily with socat. You just need a service unit like this:

[Service]
Restart=on-success
ExecStart=/usr/bin/socat -u UDP-RECV:514 STDOUT

It will blindly send anything received on the syslog service port to the systemd journal. Save the above as, say, /etc/systemd/system/syslog.service and then

# systemctl daemon-reload
# systemctl start syslog

You then just need your source to send messages to UDP port 514 on your listening server.

You may want to enhance this to actually parse the received data and format it but it isn't necessary if all you want to do is journal what's received.

(socat is in the Arch Linux Extra repository: pacman -S socat)

Improve this answer
1
  • 5
    Good answer. I went with a quick python script since I couldn't install socat: import socket; sock = socket.socket(type=socket.SocketKind.SOCK_DGRAM); sock.bind(("0.0.0.0", 514)); while True: print(sock.recv(1024 * 1024))
    – awelkie
    Feb 28, 2017 at 11:03
2

So there is a little bit of a gap here.

Systemd does support remote messaging through the systemd-journal-gateway component. That being said these messages are not in syslog format. Syslog (as a format) is an IETF ratified spefication documented in RFC 5424 (which deprecated the previous version, RFC 3164).

More of the intricacies of making these play nicely together are documented here:

http://www.freedesktop.org/wiki/Software/systemd/syslog/

and here (man systemd-journald.service)

   systemd-journald is a system service that collects and stores logging data.
   It creates and maintains structured, indexed journals based on logging
   information that is received from the kernel, from user processes via the
   libc syslog(3) call, from STDOUT/STDERR of system services or via its native
   API. It will implicitly collect numerous meta data fields for each log
   messages in a secure and unfakeable way. See systemd.journal-fields(7) for
   more information about the collected meta data.

In summary make sure that messages are sent from syslog-ng to STDOUT and things should end up in the journal.

In following up on this a bit more I found this as well:

https://github.com/intgr/pg_journal/blob/master/doc/pg_journal.md

Where someone is writing a binding from PostgreSQL to systemd for logging. In this they cite that currently (as of the time of that file, 2013/06) multi-line messages are not supported in systemd, so watch out for that too.

Improve this answer
2

I don't know the Arch distribution. I do have Fedora 20 (including systemd) and have configured it to accept remote syslog messages.

IMHO, this functionality is not related to systemd. The systemd-journald.service interposes itself between the kernel/userspace programs and the syslog subsystem. It captures (I think) only the local messages from these sources into its journal database and then forwards them on to syslog. See for example "man systemd-journald.service" (at least on Fedora).

In my case I enable this by configuring an optional "TCP syslog receiver module" in /etc/rsyslog.conf i.e.

# Provides TCP syslog reception
$ModLoad imtcp
$InputTCPServerRun 514

A UDP module is also available.

It is also necessary to add (r)syslog rules to direct the output to the desired files. For complete documentation see: http://www.rsyslog.com/doc/

HTH.

Improve this answer
1
  • This solution doesn't apply. In Archlinux the syslog is implemented by systemd and not by rsyslog or other "traditional" syslog servers. I won't downvote the answer as it contains some truth.
    – EnzoR
    Mar 1, 2020 at 18:03
1

I installed syslog-ng and was able to receive syslog log messages. But want I really wanted was to receive syslog log messages and then write said message to journald. I could not find a way to configure syslog-ng to write remote syslog messages to journald.

So I wrote a utility to do this.

https://github.com/advantageous/rsyslog-journald-repeater

./rsyslog-journald-repeater -h
Usage of ./rsyslog-journald-repeater:
-debug
    debug flag
-host string
    hostname to listen on (default "0.0.0.0")
-port int
    port to listen on (default 5514 on darwin, default 514 on Linux, Unix, etc.)

Build files and instructions for testing and sample systemd unit files are included with the project. Enjoy!

Improve this answer
0

syslog-ng and systemd journal

From syslog-ng

Starting with syslog-ng version 3.6.1 the default system() source on Linux systems using systemd uses journald as its standard system() source.

If you wish to use both the journald and syslog-ng files, ensure the following settings are in effect. For systemd-journald, in the /etc/systemd/journald.conf file, Storage= either set to auto or unset (which defaults to auto) and ForwardToSyslog= set to no or unset (defaults to no). For /etc/syslog-ng/syslog-ng.conf, you need the following source stanza:

 source src {
   system();
   internal();
 };

If, on the other hand, you wish not to retain the journald logs, but only syslog-ng's text logs, set Storage=volatile and ForwardToSyslog=yes in /etc/systemd/journald.conf. This will store journald in ram. As of syslog-ng 3.6.3, syslog-ng is using journald as the system() source so if you set Storage=none, the systemd journal will drop all messages and not forward them to syslog-ng.

After the change restart the systemd-journald.service and syslog-ng.servicedaemons.

Improve this answer
-1

There is an easy workaround which is less hackish than that by @starfry which is still a real solution as all stuff would end up in the journal.

You can simply install a suitable syslog server with UDP:514/TCP:514 support. My favorite is rsyslog which is in AUR only while syslog-ng is in the main repos, instead. This daemon would just receive the syslog events from network ad store them in local plain text files.

The precise configuration to just read from the socket(s) is left to the keen reader (RTFM).

Improve this answer

You must log in to answer this question.