[Solved] Systemd journal in conjunction with syslog-ng?

PaulBx1 · 2012-08-30 02:57:34

The wiki has this item:

https://wiki.archlinux.org/index.php/Sy … log_daemon

I'm just wondering what that is all about. Is that for causing systemd to be the source of syslog log entries rather than syslog?

I don't really see the point of this, and don't want to be double-logging everything. I'm happy with the systemd journal (for now). Should I just shut down syslog-ng? I assume the command is "systemctl disable syslog-ng.service"?

Last edited by PaulBx1 (2012-08-30 07:14:39)

WonderWoofy · 2012-08-30 03:03:21

Yes, I believe the wiki tells you this is a reasonable option on the systemd page.

PaulBx1 · 2012-08-30 03:14:32

I didn't see that anywhere, but I will go ahead and disable it.

I tried the analyze thing, which crashed:

[root@myhost ~]# systemd-analyze
Traceback (most recent call last):
  File "/usr/bin/systemd-analyze", line 3, in <module>
    import getopt, dbus, sys, os
ImportError: No module named dbus

progandy · 2012-08-30 03:33:42

You'll need python2-dbus for this tool to work.

...
Optional Deps  : initscripts: legacy support for /etc/rc.conf
                 python2-cairo: systemd-analyze
                 python2-dbus: systemd-analyze
                 systemd-sysvcompat: symlink package to provide sysvinit binaries
                 cryptsetup: required for encrypted block devices
...

PaulBx1 · 2012-08-30 03:47:38

Thanks, that did it, although how you figured that out has me wondering...

I can stop syslog-ng, and then disable it, and verify it's no longer in the list of services. But when I reboot it is running again.

progandy · 2012-08-30 04:12:16

Thanks, that did it, although how you figured that out has me wondering...

Why do you think the package info in pacman contains a list with optional dependencies? And the error said that analyze is missing a dbus module. It is even mentioned in the wiki.

PaulBx1 · 2012-08-30 06:10:02

I found some information on killing syslog-ng:

5. Consider disabling syslog. The journal is used anyway on newer systemd systems, and is usually more than sufficient for desktops, and embedded, and even many servers. Just uninstall all syslog implementations and remember that "journalctl" will get you a pixel perfect copy of the classic /var/log/messages message log. To make journal logs persistent (i.e. so that they aren't lost at boot) make sure to run "mkdir -p /var/log/journal".

http://freedesktop.org/wiki/Software/sy … imizations

So it looks like I have to uninstall syslog-ng, not just disable it.

PaulBx1 · 2012-08-30 07:14:08

Ah, I found it in my rc.conf daemons array. Just took it out of there and it is gone now. Guess I really didn't go through the whole process of getting rid of rc.conf...

lahwaacz · 2012-08-30 09:35:45

When I disable syslog-ng, I can no longer use the 'logger foo' command (the message is not shown in journalctl). Is it intended behaviour or am I doing something wrong?

Last edited by lahwaacz (2012-08-30 09:36:11)

ataraxia · 2012-08-30 15:24:01

lahwaacz wrote:

When I disable syslog-ng, I can no longer use the 'logger foo' command (the message is not shown in journalctl). Is it intended behaviour or am I doing something wrong?

Works here.

lahwaacz · 2012-08-30 18:00:05

ataraxia wrote:

lahwaacz wrote:
When I disable syslog-ng, I can no longer use the 'logger foo' command (the message is not shown in journalctl). Is it intended behaviour or am I doing something wrong?
Works here.

Can you please post your /etc/systemd/journald.conf file? I'd really like to make this work...

PaulBx1 · 2012-08-30 19:45:32

"logger foo" works for me too. I have not messed with the conf file at all; it is the stock file. Have you modified yours? Back out the mods if you have...

I'm using "journalctl -f" to see what goes into the log. "foo" shows up there...

PaulBx1 · 2012-08-30 19:49:24

I renamed my rc.conf to rc.conf.old and my rc.local to rc.local.old. Now I get complaints in the log about not finding rc.conf and rc.local. I tried disabling rc-local.service but that didn't help. Anyone know how to stop systemd looking for these files? I will dig through the systemd docs some more...

ataraxia · 2012-08-30 20:01:54

PaulBx1 wrote:

I renamed my rc.conf to rc.conf.old and my rc.local to rc.local.old. Now I get complaints in the log about not finding rc.conf and rc.local. I tried disabling rc-local.service but that didn't help. Anyone know how to stop systemd looking for these files? I will dig through the systemd docs some more...

Install systemd-sysvcompat, and remove initscripts and sysvinit. Those compatibility units are part of initscripts, so that's the best way to get rid of them.

lahwaacz · 2012-08-30 20:14:41

PaulBx1 wrote:

"logger foo" works for me too. I have not messed with the conf file at all; it is the stock file. Have you modified yours? Back out the mods if you have...
I'm using "journalctl -f" to see what goes into the log. "foo" shows up there...

Even if I comment out everything in /etc/systemd/journald.conf, stop syslog-ng.service and restart systemd-journald.service, it still doesn't work. I've also noticed that there are several options regarding logging in /etc/systemd/system.conf - are those relevant?

PaulBx1 · 2012-08-30 20:33:15

Did you make sure syslog does not show up in your rc.conf "daemons" array? That was what was screwing me up. You can tell if syslog is still operating by doing a "systemctl list-units".

This is my conf file:

#  This file is part of systemd.
#
#  systemd is free software; you can redistribute it and/or modify it
#  under the terms of the GNU Lesser General Public License as published by
#  the Free Software Foundation; either version 2.1 of the License, or
#  (at your option) any later version.
#
# See journald.conf(5) for details

[Journal]
#Compress=yes
#RateLimitInterval=10s
#RateLimitBurst=200
#SystemMaxUse=
#SystemKeepFree=
#SystemMaxFileSize=
#SystemMinFileSize=
#RuntimeMaxUse=
#RuntimeKeepFree=
#RuntimeMaxFileSize=
#RuntimeMinFileSize=
#ForwardToSyslog=yes
#ForwardToKMsg=no
#ForwardToConsole=no
#ImportKernel=no
#TTYPath=/dev/console
#MaxLevelStore=debug
#MaxLevelSyslog=debug
#MaxLevelKMsg=notice
#MaxLevelConsole=info
#Storage=auto

Last edited by PaulBx1 (2012-08-30 20:35:16)

lahwaacz · 2012-08-30 20:49:41

PaulBx1 wrote:

Did you make sure syslog does not show up in your rc.conf "daemons" array? That was what was screwing me up. You can tell if syslog is still operating by doing a "systemctl list-units".

I don't have rc.conf file and I'm pretty sure syslog-ng was not running. But maybe the mere presence of syslog-ng.service, which contains 'Alias=syslog.service', caused this behaviour. Will try uninstalling syslog-ng.

PaulBx1 · 2012-08-30 21:06:37

Install systemd-sysvcompat, and remove initscripts and sysvinit.

And so it says there, right in the systemd wiki. Just because it's nicely written down, and just because I read it, does not mean I will understand it. <sigh>

Anyway thanks, now I am "pure" systemd. Still have some oddities in my log but I will see if I can chase them down.

lahwaacz, did you install systemd-sysvcompat too? Might take care of your problems...

lahwaacz · 2012-08-31 00:57:04

Just uninstalled syslog-ng, and it's working! Thanks for the suggestions.

Arch Linux

#1 2012-08-30 02:57:34

[Solved] Systemd journal in conjunction with syslog-ng?

#2 2012-08-30 03:03:21

Re: [Solved] Systemd journal in conjunction with syslog-ng?

#3 2012-08-30 03:14:32

Re: [Solved] Systemd journal in conjunction with syslog-ng?

#4 2012-08-30 03:33:42

Re: [Solved] Systemd journal in conjunction with syslog-ng?

#5 2012-08-30 03:47:38

Re: [Solved] Systemd journal in conjunction with syslog-ng?

#6 2012-08-30 04:12:16

Re: [Solved] Systemd journal in conjunction with syslog-ng?

#7 2012-08-30 06:10:02

Re: [Solved] Systemd journal in conjunction with syslog-ng?

#8 2012-08-30 07:14:08

Re: [Solved] Systemd journal in conjunction with syslog-ng?

#9 2012-08-30 09:35:45

Re: [Solved] Systemd journal in conjunction with syslog-ng?

#10 2012-08-30 15:24:01

Re: [Solved] Systemd journal in conjunction with syslog-ng?

#11 2012-08-30 18:00:05

Re: [Solved] Systemd journal in conjunction with syslog-ng?

#12 2012-08-30 19:45:32

Re: [Solved] Systemd journal in conjunction with syslog-ng?

#13 2012-08-30 19:49:24

Re: [Solved] Systemd journal in conjunction with syslog-ng?

#14 2012-08-30 20:01:54

Re: [Solved] Systemd journal in conjunction with syslog-ng?

#15 2012-08-30 20:14:41

Re: [Solved] Systemd journal in conjunction with syslog-ng?

#16 2012-08-30 20:33:15

Re: [Solved] Systemd journal in conjunction with syslog-ng?

#17 2012-08-30 20:49:41

Re: [Solved] Systemd journal in conjunction with syslog-ng?

#18 2012-08-30 21:06:37

Re: [Solved] Systemd journal in conjunction with syslog-ng?

#19 2012-08-31 00:57:04

Re: [Solved] Systemd journal in conjunction with syslog-ng?

Board footer