On Sun, Apr 8, 2018 at 9:35 PM, Christian Kujau <fedora(a)nerdbynature.de> wrote:
I was able to disable journald similar to this:
systemctl stop systemd-journald-dev-log.socket systemd-journald.socket
systemd-journald.service
systemctl mask systemd-journald-dev-log.socket systemd-journald.socket
systemd-journald.service
(I tried to "disable" those services first, but somehow journald got started
anyway on the next reboot).
Configure rsyslog with:
$AddUnixListenSocket /var/run/systemd/journal/syslog
$SystemLogSocketName /var/run/systemd/journal/syslog
Or with the new configuration format[0]:
module(load="imuxsock" SysSock.Name="/run/systemd/journal/syslog"
Socket="/var/run/systemd/journal/syslog")
I also had to adjust the /dev/log symlink to point to /var/run/systemd/journal/syslog, so
that programs like logger(1) will still work. Added the following to /etc/rc.local (or
wherevery custom startup routines were configured):
ln -svf /var/run/systemd/journal/syslog /dev/log | logger -t "$0"
If you disable journald, this is a minimal configuration file that'll
use the default "/dev/log" and "proc/kmsg":
th@localhost ~ $ cat /etc/rsyslog.conf
module(load="imuxsock")
module(load="imklog")
global(workDirectory="/var/lib/rsyslog")
*.* action(type="omfile" file="/var/log/messages")
th@localhost ~ $
[ If you don't disable journald in dracut, you'll still have logs (for
the initramfs) output via "journalctl" reading "/run/log/journal/*" ]