On 02/09/2012 03:29 PM, Dave Reisner wrote:
> - With the journal enabled (and it is enabled by default), you no longer
> need to run a syslog daemon (i.e. syslog-ng or rsyslog). The journal,
> by default, writes to /run/systemd/journal (meaning logs will poof on
> reboot). If you want to keep your logs, simply create
> /var/log/journal. If you really want to keep using a syslog daemon,
> you must tell it to read from /run/systemd/journal/socket, NOT
> /dev/log.
I know I do not longer need to run a syslog daemon, but I like my logs in human
readable form. So, being a obedient ml reader, I configured my syslog-ng to read
from said new socket
unix-dgram("/run/systemd/journal/socket");
instead of the old /dev/log. But since then my logs are incomplete at best. So
here are my questions:
- Why are the logs read from /run/systemd/journal/socket incomplete and how do
I fix this?
- Why do I even have to change the socket? /dev/log is still there and still
works like a charm.
