How do I restore `/dev/log` in systemd+rsyslog host?

Asking and answering my own question because Google was not very helpful on this one.

Normally, with rsyslogd, the imuxsock module will create the /dev/log socket on its own, unlinking the previous entry before creating it. When rsyslogd is stopped (possibly because restart which fails because of faulty configuration), rsyslogd removes /dev/log.

However, the rsyslog supplied with RHEL7 is expected to be used in conjunction with systemd, and the imuxsock module will actually open and remove /run/systemd/journal/syslog socket. Meanwhile, the /dev/log device is created by the system service-file systemd-journald.socket which triggers journald.

Apparently, whether or not $imjournal module is used, the following works.

In sum, if /dev/log disappears:

  1. restart systemd-journald.socket:

    systemctl restart systemd-journald.socket
    
  2. then restart rsyslogd

    systemctl start rsyslogd
    

UPDATE: I believe restart rsyslogd might re-delete the socket if rsyslogd is already running.


The systemctl restart systemd-journald.socket && systemctl restart rsyslog solution did not work for me on Ubuntu 16.04.

Instead, I had to recreate /dev/log as a symlink to /run/systemd/journal/dev-log:

ln -s /run/systemd/journal/dev-log /dev/log