Control: tags -1 - moreinfo On Thu, Feb 26, 2026 at 04:08:55PM +0100, lorenzo wrote: > On Sat, 21 Feb 2026 15:57:56 +0000 Andrew Bower <[email protected]> wrote: > > When run under systemd and runit-run, the socklog-unix service listens > > to /dev/log, which means that syslog traffic is stolen from journald > > and any logs made to journald directly (possibly quite important to > > see if they have been registered directly by systemd) do not appear in > > socklog logs. > > > > This can be fixed quite easily by listening to journald's syslog proxy > > socket when it is running. See patch below for a tested solution. > > I'm fine with this, but just to be sure: by listening to journald's > socket aren't we conflicting with journald?
On the contrary: at present we are conflicting with journald by stealing its access to syslog and therefore the two logging daemons have disjoint access to the totality of the logging available. Let me explain: With systemd-journald, /dev/log is a symlink to /run/systemd/journal/dev-log, which is journald's socket for RECEIVING syslog messages. If socklog listens on /dev/log, it removes journald's access to these messages. Now, journald integrates these messages and messages it acquires from other sources, such as directly (e.e.g with logger --journald) and COPIES them onto a socket /run/systemd/journal/syslog. Therefore by listening on /run/systemd/journal/syslog, socklog can get to RECEIVE ALL system log messages WITHOUT denying them to journald. In other words, it can do what rsyslog would do and therefore be a drop-in replacement.
