case study - journalctl - where is logger output

[Tom H]

On Wed, Sep 17, 2014 at 6:40 AM, Balint Szigeti <balint.szgt at gmail.com> wrote:
>
> Well, I have definitely a problem:
>
> [root at szigeti-6560b ~]# vi /etc/systemd/journald.conf
> [root at szigeti-6560b ~]# grep none $_
> Storage=none
> [root at szigeti-6560b ~]# systemctl restart systemd-journald.service
> [root at szigeti-6560b ~]# logger foo
> [root at szigeti-6560b ~]# grep foo /var/log/messages
> [root at szigeti-6560b ~]# journalctl -n 100 |grep foo
> [root at szigeti-6560b ~]#
> [root at szigeti-6560b ~]# vi /etc/systemd/journald.conf
> [root at szigeti-6560b ~]# systemctl restart systemd-journald.service
> [root at szigeti-6560b ~]# grep Storage /etc/systemd/journald.conf
> #Storage=none
> #Storage=auto
> [root at szigeti-6560b ~]# logger AAAAAAAAAAA
> [root at szigeti-6560b ~]# grep AAAAAA /var/log/messages
> Sep 17 11:38:14 SZIGETI-6560B bszigeti: AAAAAAAAAAA
> [root at szigeti-6560b ~]# journalctl -n 100 |grep AAAA
> Sep 17 11:38:14 szigeti-6560b bszigeti[28839]: AAAAAAAAAAA

AIUI, imjournal needs a file for rsyslog to read journald logs so it
won't work with "Storage=none".

To forward to rsyslog you have to:

- use "Storage=volatile" (if you don't want to use auto/persistent) in
"/etc/systemd/journald.conf" so journald will log to
"/run/systemd/journal/" and imjournal will pick up logs from there

or

- use "$AddUnixListenSocket /run/systemd/journal/syslog" in
"/etc/rsyslog.d/sd-socket.conf" so journald will log to
"/run/systemd/journal/syslog" and imuxsocket will pick up logs from
there (untested)