I'm feeling like I've overlooked the obvious, but I can't figure out how to get my Arch Linux server, which uses systemd, to receive and log syslog messages from a remote system.

I have a Cisco 678 DSL modem and a DD-WRT WAP, and both can be configured to send syslog-format messages to some other machine. I'd like that machine to be my Arch Linux server.

I've googled around, and all I find is that "systemd replaces syslog", or that I no longer need to run syslog or something equally irrelevant to my question.

UPDATE

I have asked on the Arch forums and gotten no relevant answers. I've installed syslog-ng just to listen on UDP port 514. syslog-ng writes messages from my Cisco 678, and a DD-WRT WAP I've got. Unfortunately, the messages don't end up in systemd's journal, but rather in flat files. So, no exact solution, but something of a workaround. I'd rather have the syslog messages in the journal, not in flat files.

  • systemd uses its own log. There's also metalog, which is available in the core Arch repos--I, personally, use all three: syslog, systemd's journal, and metalog. Try checking the systemd journal. If I recall correctly, syslog, ever since the switch to systemd, has been configured to send all of its messages and such to systemd's journal. – Alexej Magura Jul 30 '13 at 19:58

You can write a poor man's syslog server quite easily with socat. You just need a service unit like this:

[Service]
Restart=on-success
ExecStart=/usr/bin/socat -u UDP-RECV:514 STDOUT

It will blindly send anything received on the syslog service port to the systemd journal. Save the above as, say, /etc/systemd/system/syslog.service and then

# systemctl daemon-reload
# systemctl start syslog

You then just need your source to send messages to UDP port 514 on your listening server.

You may want to enhance this to actually parse the received data and format it but it isn't necessary if all you want to do is journal what's received.

(socat is in the Arch Linux Extra repository: pacman -S socat)

  • 1
    Good answer. I went with a quick python script since I couldn't install socat: import socket; sock = socket.socket(type=socket.SocketKind.SOCK_DGRAM); sock.bind(("0.0.0.0", 514)); while True: print(sock.recv(1024 * 1024)) – awelkie Feb 28 '17 at 11:03

So there is a little bit of a gap here.

Systemd does support remote messaging through the systemd-journal-gateway component. That being said these messages are not in syslog format. Syslog (as a format) is an IETF ratified spefication documented in RFC 5424 (which deprecated the previous version, RFC 3164).

More of the intricacies of making these play nicely together are documented here:

http://www.freedesktop.org/wiki/Software/systemd/syslog/

and here (man systemd-journald.service)

   systemd-journald is a system service that collects and stores logging data.
   It creates and maintains structured, indexed journals based on logging
   information that is received from the kernel, from user processes via the
   libc syslog(3) call, from STDOUT/STDERR of system services or via its native
   API. It will implicitly collect numerous meta data fields for each log
   messages in a secure and unfakeable way. See systemd.journal-fields(7) for
   more information about the collected meta data.

In summary make sure that messages are sent from syslog-ng to STDOUT and things should end up in the journal.

In following up on this a bit more I found this as well:

https://github.com/intgr/pg_journal/blob/master/doc/pg_journal.md

Where someone is writing a binding from PostgreSQL to systemd for logging. In this they cite that currently (as of the time of that file, 2013/06) multi-line messages are not supported in systemd, so watch out for that too.

I don't know the Arch distribution. I do have Fedora 20 (including systemd) and have configured it to accept remote syslog messages.

IMHO, this functionality is not related to systemd. The systemd-journald.service interposes itself between the kernel/userspace programs and the syslog subsystem. It captures (I think) only the local messages from these sources into its journal database and then forwards them on to syslog. See for example "man systemd-journald.service" (at least on Fedora).

In my case I enable this by configuring an optional "TCP syslog receiver module" in /etc/rsyslog.conf i.e.

# Provides TCP syslog reception
$ModLoad imtcp
$InputTCPServerRun 514

A UDP module is also available.

It is also necessary to add (r)syslog rules to direct the output to the desired files. For complete documentation see: http://www.rsyslog.com/doc/

HTH.

I installed syslog-ng and was able to receive syslog log messages. But want I really wanted was to receive syslog log messages and then write said message to journald. I could not find a way to configure syslog-ng to write remote syslog messages to journald.

So I wrote a utility to do this.

https://github.com/advantageous/rsyslog-journald-repeater

./rsyslog-journald-repeater -h
Usage of ./rsyslog-journald-repeater:
-debug
    debug flag
-host string
    hostname to listen on (default "0.0.0.0")
-port int
    port to listen on (default 5514 on darwin, default 514 on Linux, Unix, etc.)

Build files and instructions for testing and sample systemd unit files are included with the project. Enjoy!

syslog-ng and systemd journal

From syslog-ng

Starting with syslog-ng version 3.6.1 the default system() source on Linux systems using systemd uses journald as its standard system() source.

If you wish to use both the journald and syslog-ng files, ensure the following settings are in effect. For systemd-journald, in the /etc/systemd/journald.conf file, Storage= either set to auto or unset (which defaults to auto) and ForwardToSyslog= set to no or unset (defaults to no). For /etc/syslog-ng/syslog-ng.conf, you need the following source stanza:

 source src {
   system();
   internal();
 };

If, on the other hand, you wish not to retain the journald logs, but only syslog-ng's text logs, set Storage=volatile and ForwardToSyslog=yes in /etc/systemd/journald.conf. This will store journald in ram. As of syslog-ng 3.6.3, syslog-ng is using journald as the system() source so if you set Storage=none, the systemd journal will drop all messages and not forward them to syslog-ng.

After the change restart the systemd-journald.service and syslog-ng.servicedaemons.

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.