A simple start
The bare minimum you need to get circologd on a systemd-based system is this unit. Other options with more features or more security are provided below
[Unit]
Description=In-memory logging
[Service]
User=root
Group=adm
ExecStart=/usr/local/sbin/circologd -syslogd-socket /run/circolog/syslog.sock -buffer-size 2000 -query-socket /run/circolog/query.sock
[Install]
WantedBy=multi-user.target
A better unit
This is another unit, which has several security features, such as DynamicUser
, filesystem restrictions, and
more.
[Unit]
Description=In-memory logging
[Service]
DynamicUser=true
Group=adm
RuntimeDirectory=circolog
# this is important: circologd will respect umask, so if you want to have files that are not world-readable, you must set it
RuntimeDirectoryMode=0750
UMask=0026
ProtectSystem=full
ExecStart=/usr/local/sbin/circologd -syslogd-socket /run/circolog/syslog.sock -buffer-size 2000 -query-socket /run/circolog/query.sock
# security restrictions; useful, but not needed
PrivateTmp=true
PrivateNetwork=true
NoNewPrivileges=true
Restrictnamespaces=true
#optional: watchdog
WatchdogSec=30
[Install]
WantedBy=multi-user.target
Journald
None of those are integrated with journald, however. The simplest way to integrate with journald is the following.
First of all, ensure ForwardToSyslog=yes
in /etc/systemd/journald.conf
.
Then, you need to run circologd as root and bind it to a special
address.
Ok, you don't strictly need to run it as root, but that's the easiest way to run it.
Here is a working unit for this:
[Unit]
Description=In-memory logging
[Service]
User=root
Group=adm
ExecStart=/usr/local/sbin/circologd -syslogd-socket /run/systemd/journal/syslog -buffer-size 2000 -query-socket /run/circolog/query.sock
[Install]
WantedBy=multi-user.target
journald with socket activation
To run circologd as non-root, while listening on a root-owned socket (/run/systemd/journal/syslog
) use
socket activation. Create a unit in /etc/systemd/system/circolog.service
:
[Unit]
Description=In-memory logging
[Service]
User=nobody
Group=nogroup
ExecStart=/usr/local/sbin/circologd -syslogd-socket "" -buffer-size 2000 -query-socket /run/circolog/query.sock
[Install]
WantedBy=multi-user.target
Then symlink the syslog.service
unit to the newly created one:
ln -sf /etc/systemd/system/circolog.service /etc/systemd/system/syslog.service
and restart the service:
systemctl daemon-reload
systemctl restart syslog.service
Now circolog is activated and receives messages from journald
.