SYSTEMD-NETLOGD(8)

NAME
systemd-netlogd - systemd-netlogd Documentation

    •   Name

    •   Synopsis

    •   Description

    •   Installation

    •   User Creation

    •   Running the Service

    •   Configuration

    •   [Network] Section Options

    •   Examples

        •   UDP Multicast

        •   Unicast UDP (RFC 3339)

        •   Custom Structured Data

        •   TLS

        •   DTLS

        •   Extract Journal Metadata

        •   TCP with Filtering

    •   Using Structured Data and Message IDs

    •   Files

    •   Troubleshooting

    •   See Also

    •   Author

    •   Colophon

NAME

systemd-netlogd - Forward systemd journal messages to remote hosts via Syslog

SYNOPSIS

            systemd-netlogd [OPTIONS...]

DESCRIPTION

systemd-netlogd is a lightweight, network-aware daemon for forwarding log messages from the systemd journal to remote hosts over the network using the Syslog protocol (RFC 5424 and RFC 3339). It supports unicast and multicast destinations, ensuring efficient log aggregation in distributed environments.

Key features:

    •   Efficient forwarding: Reads journal entries sequentially and transmits them one-by-one without buffering or additional disk usage.

    •   Network integration: Leverages sd-network to start forwarding when the network is up and pause when it's down.

    •   Secure transports: Supports UDP (default), TCP, TLS, and DTLS (RFC 6012 for datagram security).

    •   Flexible output: Formats logs as RFC 5424 (default), RFC 5425 (length-prefixed for TLS), or RFC 3339.

    •   Isolation: Runs as the dedicated system user systemd-journal-netlog.

    •   Filtering: Exclude specific syslog facilities or levels; target journal namespaces.

This daemon is ideal for edge devices, servers, or cloud setups requiring centralized logging with minimal resource impact.

INSTALLATION

Use your distribution's package manager:

    •   Ubuntu/Debian: sudo apt install systemd-netlogd

    •   Fedora/RHEL: Available via COPR repositories (search for systemd-netlogd).

    •   Arch Linux: Build from AUR (systemd-netlogd-git).

For building from source, see the GitHub repository <https://github.com/systemd/systemd-netlogd>.

USER CREATION

The daemon requires a dedicated system user. Create it manually:

            sudo useradd -r -d / -s /usr/sbin/nologin -g systemd-journal systemd-journal-netlog

Or via sysusers.d (preferred):

            # /etc/sysusers.d/systemd-netlogd.conf
            # Type   Name                    ID   GECOS   Home directory  Shell
            u       systemd-journal-netlog  -    -       /               /bin/nologin

Apply with:

            sudo systemd-sysusers

RUNNING THE SERVICE

Enable and start via systemd:

            sudo systemctl daemon-reload
            sudo systemctl enable --now systemd-netlogd.service

    •   Logs: journalctl -u systemd-netlogd.service

    •   Manual invocation: sudo systemd-netlogd (for testing).

CONFIGURATION

Read from /etc/systemd/netlogd.conf and drop-ins in /etc/systemd/netlogd.conf.d/*.conf (INI format).

Options are in the [Network] section. Reload changes:

            sudo systemctl reload systemd-netlogd.service

[NETWORK] SECTION OPTIONS
Option | Type | Default | Description
Address= | string | (required) | Destination (unicast IP:PORT or multicast GROUP:PORT). See systemd.socket(5).
Protocol= | enum | udp | udp, tcp, tls, dtls.
LogFormat= | enum | rfc5424 | rfc5424, rfc5425 (TLS-friendly), rfc3339.
Directory= | path | system | Custom journal directory.
Namespace= | string | default | Filter: ID, * (all), +ID (ID + default).
ConnectionRetrySec= | time | 30s | Reconnect delay (≥1s). See systemd.time(5).
TLSCertificateAuthMode= | enum | no | no, allow, deny, warn (validation modes).
TLSServerCertificate= | path | – | PEM CA/server cert for validation.
KeepAlive= | bool | false | Enable TCP keepalives (SO_KEEPALIVE). See socket(7).
KeepAliveTimeSec= | sec | 7200 | Idle before probes (TCP_KEEPIDLE).
KeepAliveIntervalSec= | sec | 75 | Probe interval (TCP_KEEPINTVL).
KeepAliveProbes= | int | 9 | Probes before close (TCP_KEEPCNT).
SendBuffer= | size | system | Send buffer (SO_SNDBUF; K/M/G suffixes).
NoDelay= | bool | false | Disable Nagle (TCP_NODELAY). See tcp(7).
StructuredData= | string | – | Fixed SD-ID (e.g., for Loggly).
UseSysLogStructuredData= | bool | false | Extract SYSLOG_STRUCTURED_DATA from journal.
UseSysLogMsgId= | bool | false | Extract SYSLOG_MSGID from journal.
ExcludeSyslogFacility= | list | – | Skip facilities (e.g., auth authpriv).
ExcludeSyslogLevel= | list | – | Skip levels (e.g., debug).

Facilities: kern, user, mail, daemon, auth, syslog, lpr, news, uucp, cron, authpriv, ftp, ntp, security, console, solaris-cron, local0–local7.

Levels: emerg, alert, crit, err, warning, notice, info, debug.

EXAMPLES

  UDP Multicast

            [Network]
            Address=239.0.0.1:6000

  Unicast UDP (RFC 3339)

            [Network]
            Address=192.168.8.101:514
            LogFormat=rfc3339

  Custom Structured Data

            [Network]
            Address=192.168.8.101:514
            StructuredData=[1ab456b6-90bb-6578-abcd-5b734584aaaa@41058]

  TLS

            [Network]
            Address=192.168.8.101:514
            Protocol=tls
            LogFormat=rfc5425
            TLSCertificateAuthMode=deny

  DTLS

            [Network]
            Address=192.168.8.101:4433
            Protocol=dtls
            TLSCertificateAuthMode=warn

  Extract Journal Metadata

            [Network]
            Address=192.168.8.101:514
            LogFormat=rfc5424
            UseSysLogStructuredData=yes
            UseSysLogMsgId=yes

  TCP with Filtering

            [Network]
            Address=192.168.8.101:514
            Protocol=tcp
            ExcludeSyslogFacility=auth authpriv
            ExcludeSyslogLevel=debug

USING STRUCTURED DATA AND MESSAGE IDS

Tag journal entries for extraction:

            #include <systemd/sd-journal.h>

            int main(void) {
                sd_journal_send(
                    "MESSAGE=%s", "Message to process",
                    "PRIORITY=%i", 4,  // warning
                    "SYSLOG_FACILITY=%i", 1,  // user
                    "SYSLOG_MSGID=%s", "1011",
                    "SYSLOG_STRUCTURED_DATA=%s", R"([exampleSDID@32473 iut="3" eventSource="Application"])",
                    NULL);
                return 0;
            }

Compile: gcc example.c -lsystemd.

FILES

    /etc/systemd/netlogd.conf
        Main configuration.

    /etc/systemd/netlogd.conf.d/*.conf
        Drop-in snippets.

    /lib/systemd/system/systemd-netlogd.service
        Service unit.

TROUBLESHOOTING

    •   No forwarding: Check journalctl -u systemd-netlogd; verify network and permissions.

    •   TLS errors: Use openssl verify -CAfile cert.pem server.crt; set TLSCertificateAuthMode=allow for testing.

    •   Test setup: Generate logs with logger -p user.info "Test"; receive with nc -u -l 514.

    •   Debug mode: Override service: systemctl edit systemd-netlogd and add StandardOutput=journal+console.

SEE ALSO

systemd.socket(5), systemd.time(5), socket(7), tcp(7), systemd-journald(8)

    •   RFC 5424, RFC 5425, RFC 3339, RFC 6012

    •   Project: <https://github.com/systemd/systemd-netlogd>

AUTHOR

Susant Sahani <<ssahani@gmail.com>>

COLOPHON

This page is part of systemd-netlogd (version 1.4.5, December 1, 2025).

Author
Susant Sahani <ssahani@gmail.com>

Copyright
2024, Susant Sahani