How do I restore `/dev/log` in systemd+rsyslog host?
Asking and answering my own question because Google was not very helpful on this one.
Normally, with rsyslogd
, the imuxsock
module will create the /dev/log
socket on its own, unlinking the previous entry before creating it. When rsyslogd
is stopped (possibly because restart which fails because of faulty configuration), rsyslogd removes /dev/log
.
However, the rsyslog supplied with RHEL7
is expected to be used in conjunction with systemd
, and the imuxsock
module will actually open and remove /run/systemd/journal/syslog
socket. Meanwhile, the /dev/log
device is created by the system service-file systemd-journald.socket
which triggers journald
.
Apparently, whether or not $imjournal
module is used, the following works.
In sum, if /dev/log
disappears:
restart systemd-journald.socket:
systemctl restart systemd-journald.socket
then restart rsyslogd
systemctl start rsyslogd
UPDATE: I believe restart rsyslogd
might re-delete the socket if rsyslogd
is already running.
The systemctl restart systemd-journald.socket && systemctl restart rsyslog
solution did not work for me on Ubuntu 16.04.
Instead, I had to recreate /dev/log
as a symlink to /run/systemd/journal/dev-log
:
ln -s /run/systemd/journal/dev-log /dev/log