How do i get a systemd unit to redirect or copy logs to syslog?

Question

I'm running Ubuntu 16.04 Server with a node.js service, where i need to get the log written to a file, just like the good old syslog :)

I've been googling half the night, but nothing has come up.

The reason behind this odd need, is that we are collecting the logs via filebeat and sending it to an ElasticSearch cluster.

Answer 1

Found a workaround using systemd to run journalctl immediately after starting the service I need to get a log from.

Add a systemd service script to create a log file for "MyService" /etc/systemd/system/multi-user.target.wants/MyService-journalctl-to-log.service:

[Unit]
Description=MyService journalctl parser to filebeat
#I needed to get a log file for filebeat to read
#Wants=filebeat.service
#After=filebeat.service

[Service]
Restart=always
RestartSec=5
ExecStart=/bin/sh -c '/bin/journalctl --no-tail -f -u MyService.service  > /var/log/MyService.log 2>&1'
ExecStartPre=/bin/journalctl --vacuum-size=10M

[Install]
WantedBy=multi-user.target

Enable and start the new systemd service

systemctl enable MyService-journalctl-to-log.service
systemctl start MyService-journalctl-to-log.service

Answer 2

DISCLAIMER: If any of the directories is mistaken, please let me know or edit it yourself if you can. I am writing this from the top of my head.

I know this is old but if your SystemD version is modern enough you can use it to your advantage. You can let the already existing OS services and schedules do what they're good for. Your unit file can tell the daemon that output must travel to syslog (man systemd.exec)

[Unit]
Description=...

[Service]
WorkingDirectory=...
User=...
Group=...

StandardOutput=syslog
StandardError=inherit

SyslogIdentifier=<program-name>
SyslogFacility=local4 # just because... choose your own

ExecStart=... your command

[Install]
WantedBy=multi-user.target

Put the file in /usr/local/lib/systemd/system/ so that you do not mix your unit files with other package maintainers (man systemd.unit I think)

Don't forget to let SystemD know that this unit is available (or modified):

sudo systemctl daemon-reload

This will add your unit file to the multi-user.target directory.

Now that you have your output running towards rsyslog, it's time to tell rsyslogd what to do with it. Fill /etc/rsyslog.conf.d/10-<your-program-name>.conf with the following instructions

if ($programname == "<your-programname>") then {
        action(
                type="omfile"
                FileOwner="syslog"
                FileGroup="adm"
                File="/var/log/<programname>/<programname>.log"
                FileCreateMode="0644"
        )
        stop
}

if you are missing any directories, create them. Remember to put in the correct ownerships and permissions. The log directories can be set up for syslog:adm.

Restart rsyslogd so that it picks up the configuration.

But we are not done yet. The file will just grow non stop. Configure logrotate so that you can let your logs rotate. Put the following configuration in /etc/logrotate.conf.d/<programname>

/var/log/<programname>
{
        rotate 7
        daily
        missingok
        notifempty
        delaycompress
        compress
}

This is just a basic setup. Make your own personal adjustments (there are a lot of man pages to be read). There is no logrotate service, it is just a scheduled task that usually runs everyday (I don't remember if cron or anacron).

Beware if your logs grow too fast in a single day. If you want logrotate to run differently (ie: size based), something else has to be done.