Lightweight, network-aware daemon for forwarding systemd journal logs to remote syslog servers

Forward your systemd journal to centralized logging infrastructure with zero local buffering, automatic network detection, and secure transport options (UDP, TCP, TLS, DTLS).

# Install (Ubuntu/Debian)
sudo apt install systemd-netlogd

# Or build from source
git clone https://github.com/systemd/systemd-netlogd.git
cd systemd-netlogd && make && sudo make install

# Configure
sudo tee /etc/systemd/netlogd.conf <<EOF
[Network]
Address=logs.example.com:514
Protocol=tcp
EOF

# Create system user
sudo useradd -r -d / -s /usr/sbin/nologin -g systemd-journal systemd-journal-netlog

# Start
sudo systemctl enable --now systemd-netlogd

That's it! Your logs are now being forwarded. View status with:

journalctl -u systemd-netlogd -f

• 🌐 Network-Aware: Automatically detects network state changes via sd-network
• ⚡ Zero Buffering: Sequential journal reading without local caching
• 🔒 Secure Transport: UDP, TCP, TLS (RFC 5425), DTLS (RFC 6012)
• 📋 Standard Formats: RFC 5424 (recommended), RFC 3339 (legacy BSD syslog)
• 🎯 Smart Filtering: Exclude sensitive facilities (auth/authpriv) and log levels
• 📦 Namespace Support: Forward from specific namespaces or aggregate all
• 🛡️ Hardened: Runs as unprivileged systemd-journal-netlog user with restricted capabilities
• 🔄 Fault Tolerant: Automatic reconnection with cursor persistence ensures no message loss

✓ Centralized logging for distributed systems     ✓ Security monitoring & SIEM integration
✓ Cloud log aggregation (AWS, Azure, GCP)         ✓ Compliance & audit log forwarding
✓ Edge device telemetry collection                ✓ Multi-region log consolidation
✓ Container/Kubernetes cluster logging            ✓ IoT fleet management

# Debian/Ubuntu
sudo apt install build-essential meson gperf libcap-dev libsystemd-dev libssl-dev libcmocka-dev

# Fedora/RHEL
sudo dnf install gcc meson gperf libcap-devel systemd-devel openssl-devel libcmocka-devel

git clone https://github.com/systemd/systemd-netlogd.git
cd systemd-netlogd
make                    # or: meson setup build && meson compile -C build
sudo make install       # or: sudo meson install -C build

sudo useradd -r -d / -s /usr/sbin/nologin -g systemd-journal systemd-journal-netlog

sudo systemctl daemon-reload
sudo systemctl enable --now systemd-netlogd

File: /etc/systemd/netlogd.conf (or /etc/systemd/netlogd.conf.d/*.conf for drop-ins)

Reload: sudo systemctl reload systemd-netlogd

[Network]
Address=192.168.1.100:514

[Network]
Address=logs.example.com:6514
Protocol=tls
LogFormat=rfc5425
TLSCertificateAuthMode=deny
TLSServerCertificate=/etc/pki/tls/certs/ca-bundle.crt
KeepAlive=yes
NoDelay=yes
ExcludeSyslogFacility=auth authpriv

[Network]
Address=logs7.papertrailapp.com:12345
Protocol=tls

[Network]
Address=192.168.1.100:514
Protocol=udp
ExcludeSyslogLevel=debug info
ConnectionRetrySec=5

[Network]
Address=192.168.1.100:514
Protocol=tcp
LogFormat=rfc5424
StructuredData=[app@12345 env="production" region="us-east"]

📁 More examples: See examples/ directory for 10+ production-ready configurations

#include <systemd/sd-journal.h>

int main() {
    sd_journal_send(
        "MESSAGE=User login successful",
        "PRIORITY=6",                    // info
        "SYSLOG_FACILITY=10",           // authpriv
        "SYSLOG_MSGID=LOGIN001",
        "SYSLOG_STRUCTURED_DATA=[auth@12345 user=\"alice\" ip=\"1.2.3.4\"]",
        NULL
    );
    return 0;
}

[Network]
Address=192.168.1.100:514
LogFormat=rfc5424
UseSysLogStructuredData=yes
UseSysLogMsgId=yes

# Start a test receiver
nc -ul 514                    # UDP
nc -l 514                     # TCP

# Generate test logs
logger -p user.info "Test message"
logger -p user.warning "Warning test"

# Monitor systemd-netlogd
journalctl -u systemd-netlogd -f

# Enable debug logging
sudo systemctl edit systemd-netlogd
# Add: Environment=SYSTEMD_LOG_LEVEL=debug

# Test TLS connectivity
openssl s_client -connect server:6514 -CAfile /path/to/ca.pem

systemd-netlogd runs with minimal privileges:

• Dedicated systemd-journal-netlog system user (not root)
• Capability restrictions via systemd hardening
• Filesystem isolation and protection

Best Practices:

# ✅ DO: Use TLS for remote logging
Protocol=tls
TLSCertificateAuthMode=deny

# ✅ DO: Filter sensitive logs
ExcludeSyslogFacility=auth authpriv

# ✅ DO: Use strong certificate validation
TLSServerCertificate=/etc/pki/tls/certs/ca-bundle.crt

# ❌ DON'T: Use UDP/TCP over the internet (unencrypted)
# ❌ DON'T: Disable certificate validation in production

Audit security posture:

sudo systemd-analyze security systemd-netlogd.service

💡 Quick fixes:

# Generate test log
logger -p user.info "Test from systemd-netlogd"

# Enable debug mode
sudo kill -SIGUSR1 $(pidof systemd-netlogd)

# Reset state (start from scratch)
sudo systemctl stop systemd-netlogd
sudo rm /var/lib/systemd-netlogd/state
sudo systemctl start systemd-netlogd

We welcome contributions!

Quick Start:

1. 🍴 Fork the repository
2. 🌿 Create feature branch: git checkout -b feature/amazing-feature
3. ✅ Add tests for new functionality
4. 💬 Commit with clear messages
5. 📫 Submit a pull request

Resources:

• 📖 CONTRIBUTING.md - Full contribution guide
• 🏗️ ARCHITECTURE.md - Understand the codebase
• 🧪 TESTING.md - Testing guide

Development:

# Clone and setup
git clone https://github.com/systemd/systemd-netlogd.git
cd systemd-netlogd
make

# Run tests
meson test -C build -v

# Build documentation
make -C doc

Before asking for help:

1. ✅ Check the FAQ
2. ✅ Search existing issues
3. ✅ Try troubleshooting steps above
4. ✅ Enable debug logging: Environment=SYSTEMD_LOG_LEVEL=debug

LGPL-2.1-or-later — Same license as systemd

See LICENSE file for details.

• Author: Susant Sahani
• Contributors: See all contributors
• Project: Part of the systemd ecosystem