How to setup syslog forwarding for systemd journal namespace

Question

I have a configuration /etc/systemd/[email protected] which contains the setting ForwardToSyslog=yes and a systemd service unit configured with LogNamespace=my-namespace.

The documentation after this is not clear to me how to get the journal logs from my-namespace forwarded to syslog.

I understand there are two ways of forwarding journal logs to syslog, through a UNIX domain socket or .journal file. For this case, let's say I want to setup a socket at /run/systemd/journal.my-namespace/syslog for journald to write logs to and rsyslogd to listen and forward to syslog. I have gone through the documentation but I still don't understand how I would configure this.

Answer 1

I found a minimal solution after reading the rsyslog docs which is to create an rsyslog config file /etc/rsyslog.d/my-namespace.conf with the content:

input(type="imuxsock" Socket="/run/systemd/journal.my-namespace/syslog")

Answer 2

rsyslog.conf

Following this guide, I added to the local syslog client, file /etc/rsyslog.conf

module(load="imjournal")

rsyslog module imjournal is especially for journal log messages. The same /etc/rsyslog.conf already has UDP forwarding set

*.* @some-remote-syslog-server.local:514

Then restart rsyslog

systemctl restart rsyslog.service

test

On the remote syslog server, tail the collected syslogs for that host (this path will depend on the remote syslog server configuration)

$ tail -F /var/log/rsyslog/my-host/*

On the local syslog server, follow the journal logs

$ journalctl -xf

Then create log messages using both the old logger program and the new systemd-cat program

$ echo MESSAGE FROM $(hostname) USING logger | logger -t user
$ echo MESSAGE FROM $(hostname) USING systemd-cat | systemd-cat -t user

(the log message tag user is arbitrary)

In my case, both messages, via logger and via systemd-cat, appeared in both places, the remote syslog server and the local journal logs.

This Answer does not attempt to delineate namespaces. But it did what I wanted which was to forward all journal log messages.