We set SYSLOG_PRIORITY when sending to journald to avoid our messages getting tagged with the default facility which is used for the kernel. Unfortunately: commit fd00f0e6c75b00c3d97be8670afcd9094b823855 Author: Guido Günther <agx@xxxxxxxxxxx> Date: Mon Sep 21 20:06:55 2015 +0200 Use daemon log facility for journald used the LOG_nnn constants from the syslog header without realizing that these values have a bit-shift applied. While Linux defines a LOG_FAC() macros to undo the bit-shift this doesn't appear to be standardized. So the safe thing is to just use the raw value since these values are fixed by RFC 5424. Signed-off-by: Daniel P. Berrangé <berrange@xxxxxxxxxx> --- src/util/virlog.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/src/util/virlog.c b/src/util/virlog.c index b44ad0ef6c..72b0613dfb 100644 --- a/src/util/virlog.c +++ b/src/util/virlog.c @@ -925,7 +925,13 @@ virLogOutputToJournald(virLogSource *source, journalAddString(&state, "MESSAGE", rawstr); journalAddInt(&state, "PRIORITY", virLogPrioritySyslog(priority)); - journalAddInt(&state, "SYSLOG_FACILITY", LOG_DAEMON); + /* See RFC 5424 section 6.2.1 + * + * Don't use LOG_nnn constants as those have a bit-shift + * applied for use with syslog() API, while journald + * needs the raw value + */ + journalAddInt(&state, "SYSLOG_FACILITY", 3); journalAddString(&state, "LIBVIRT_SOURCE", source->name); if (filename) journalAddString(&state, "CODE_FILE", filename); -- 2.33.1