16 Bře
2021
16 Bře
'21
17:32
Matthew Pounsett wrote:
On Tue, 16 Mar 2021 at 03:09, Robert Edmonds
<edmonds(a)debian.org> wrote:
> If I'm reading the knot source
code correctly [0,1], knotd
> unconditionally logs to the system journal interface if knotd has been
> compiled with systemd support and the system is running with systemd as
> PID 1. So, a better question might be why knot is using syslog at all on
> one of your hosts.
Thanks for the links and for clarifying the source code.
That led me to find that the two systems are running different syslog
daemons. It turns out the Debian package for rsyslogd creates the
socket /run/systemd/journal/syslog, which journald writes to, and the
Debian package for syslog-ng does not.
Inconsistency explained. Thanks!
Hmm, even if you're using syslog-ng on a Debian 10 system it should
still be generating log messages in /var/log.
The syslog-ng package depends on syslog-ng-core, which depends on
syslog-ng-mod-journal, which "provides the systemd-journal() source
plugin, which allows syslog-ng to read directly from the systemd
Journal". Apparently syslog-ng uses the sd_journal_* API to directly
read from the journal, which explains why syslog-ng wouldn't be
listening on the syslog forwarding socket that systemd-journald attempts
to write to. So it should "just work" unless you're running a
non-default configuration.
--
Robert Edmonds
edmonds(a)debian.org