I would like systemd-journald in systemd 219 (on el7, so the package is systemd-219-30.el7_3.9.x86_64) to listen for syslog messages on /run/systemd/journal/dev-log, and have /dev/log be a symlink to that file. This is the default behavior of more recent versions of systemd-journald.
The stock /lib/systemd/system/sytemd-journald.socket looks like this:
[Unit]
Description=Journal Socket
Documentation=man:systemd-journald.service(8) man:journald.conf(5)
DefaultDependencies=no
Before=sockets.target
[Socket]
ListenStream=/run/systemd/journal/stdout
ListenDatagram=/run/systemd/journal/socket
ListenDatagram=/dev/log
SocketMode=0666
PassCredentials=yes
PassSecurity=yes
ReceiveBuffer=8M
I modify that file to remove the ListenDatagram=/dev/log line.
I created a new unit, /etc/systemd/system/systemd-journal-dev-log.socket that looks like:
[Unit]
Description=Journal Socket (/dev/log)
Documentation=man:systemd-journald.service(8) man:journald.conf(5)
DefaultDependencies=no
Before=sockets.target
IgnoreOnIsolate=yes
[Socket]
Service=systemd-journald.service
ListenDatagram=/run/systemd/journal/dev-log
Symlinks=/dev/log
SocketMode=0666
PassCredentials=yes
PassSecurity=yes
ReceiveBuffer=8M
SendBuffer=8M
[Install]
WantedBy=systemd-journald.service
I modified /lib/systemd/system/systemd-journald.service so that it includes:
Sockets=systemd-journald.socket systemd-journald-dev-log.socket
I reload systemd (systemctl daemon-reload), enable the new socket systemctl enable systemd-journald-dev-log.socket) and restart all journald related units (systemctl restart systemd-journald\*), after which systemctl cat systemd-journald.socket shows that the changes are active:
# systemctl list-units | grep journald
systemd-journald.service loaded active running Journal Service
systemd-journald-dev-log.socket loaded active running Journal Socket (/dev/log)
systemd-journald.socket loaded active running Journal Socket
# systemctl cat systemd-journald.service | grep Socket
Sockets=systemd-journald.socket systemd-journald-dev-log.socket
# systemctl cat systemd-journald.socket | grep Listen
ListenStream=/run/systemd/journal/stdout
ListenDatagram=/run/systemd/journal/socket
# systemctl cat systemd-journald-dev-log.socket | grep Listen
ListenDatagram=/run/systemd/journal/dev-log
But despite the above configuration, I find that /dev/log is not a symlink:
# ls -l /dev/log
srw-rw-rw-. 1 root root 0 Sep 12 17:33 /dev/log
And in fact it has been opened by systemd-journald directly, rather than by systemd itself:
# lsof | grep /dev/log
systemd-j 186 root 5u unix 0xffff8b5076bc8000 0t0 157285 /dev/log
What's going on here? Why doesn't my socket unit work as expected? Is there any way to work around this problem that doesn't involve an upgrade to systemd?
