If somebody still is interested in this, here is my follow-up: After some digging (it is amazing how little information exist for this, not even a man page for anything journal related) I came to the conclusion that journal/socket is not meant for a logging daemon to read from. Instead journal/syslog should be used (see [1]). So your service file should look something like this: [Unit] Description=System Logger Daemon [Service] Sockets=syslog.socket ExecStartPre=-/bin/systemctl stop systemd-kmsg-syslogd.service ExecStart=/usr/sbin/syslog-ng -F ExecReload=/bin/kill -HUP $MAINPID Sockets=syslog.socket StandardOutput=null [Install] WantedBy=multi-user.target Alias=syslog.service And syslog should read from /run/systemd/journal/syslog [1] http://lwn.net/Articles/474968/
