Re: Syslog/Rsyslog/Systemctl issue

[Greg Wooledge <greg@wooledge.org>]

On Wed, Feb 01, 2023 at 11:15:58AM +0100, debian@sioban.net wrote:
> "journalctl -e" ends the 24th of October.

> ❯ journalctl -b
> -- Journal begins at Sun 2022-10-23 19:55:11 CEST, ends at Mon 2022-10-24
> 14:14:33 CEST. --
> -- No entries --

> ❯ systemctl start systemd-journald.service
> A dependency job for systemd-journald.service failed. See 'journalctl -xe'
> for details.

On my system:

unicorn:~$ systemctl cat systemd-journald.service | grep -i require
Requires=systemd-journald.socket
# /proc/<pid>/exe requires this capability. Thus if this capability is missing

unicorn:~$ systemctl cat systemd-journald.socket | grep Listen
ListenDatagram=/run/systemd/journal/socket
ListenStream=/run/systemd/journal/stdout

For you, that's at least *two* socket services that appear to be failing.
I suspect you've got something broken that's preventing these sockets
from being created, or being accessed.

Man, what I wouldn't give for a nice, clear "/run/systemd/journal/socket:
Permission denied" or "... No such file or directory" error!

/run is supposed to be mounted as a separate file system, entirely in
memory:

unicorn:~$ df /run
Filesystem     1K-blocks  Used Available Use% Mounted on
tmpfs            1215596  1924   1213672   1% /run

And the ownerships and permissions on this socket are:

unicorn:~$ namei -l /run/systemd/journal/socket
f: /run/systemd/journal/socket
drwxr-xr-x root root /
drwxr-xr-x root root run
drwxr-xr-x root root systemd
drwxr-xr-x root root journal
srw-rw-rw- root root socket

If you've got anything different, that would be important.