Q: Services logging to stderr preferred over logging to syslog?

Help
1

Hello,

I noticed services like postgresql and nginx default to logging to stderr (which is then forwarded to journald) rather than using syslog. Is there any reasoning behind it? I couldn’t find anything relevant.
I also noticed logging to stderr would often add redundant information like timestamps, but most importantly it prevents me from searching using journalctl’s --priority filters.

Thanks

1 Like
2

Hi,

I second your point that we should rather go with a richer protocol like syslog or even directly talking to journald (via libsystemd) if possible. I’m not aware of any general discussion on this point. Perhaps it’s time to create a pull request against PostgreSQL to change the default log target and see what happens.

Regards

Christian

3

Sorry, by default, I meant through the configuration set up using NixOS modules, it would just be a matter of editing those expressions.

4

I wasn’t aware the systemd would intercept syslog calls and redirect them to the unit journal logs. Is that really the case?

5

I wasn’t aware the systemd would intercept syslog calls and redirect them
to the unit journal logs. Is that really the case?

Yep. Try “logger ‘woot’” followed by “journalctl -e”

6

It does not “intercept” anything.
Syslog works by providing an API via the (default) socket /dev/log. Journald simply provides a compatible API if so configured (also default).

Any program can use said API to send logs to journald for compatibility’s sake.

7

How does it know to classify the logs back to journactl -u <service-name>?

8

It does so by setting SO_PASSCRED on the listening socket and mapping the pid of the caller back to a unit.

9

Magic! I didn’t know about this and suspect it might be one of the reasons for people to turn of syslog logging. And because 12factor is popular.

10

Triggered by your question I packaged the pg_journal PostgreSQL plugin which logs PostgreSQL messages to the systemd journal.