SyslogIdentifier not honored

[awakenrz]

Submission type

Bug report

systemd version the issue has been seen with

systemd 229

…

Used distribution

Linux version 4.15.12-x86_64-linode105 (maker@build.linode.com) (gcc version 4.9.2 (Debian 4.9.2-10+deb8u1)) #1 SMP Thu Mar 22 02:13:40 UTC 2018

In case of bug report: Expected behaviour you didn't see

I set the SyslogIdentifier property of my unit under [Service] section.
I verified that the value is set in using systemctl show <unit name>.

In case of bug report: Unexpected behaviour you saw

In journalctl --unit <unit name> -o verbose, I still see SYSLOG_IDENTIFIER defaults to the path to the binary, as oppose to the value I set in SyslogIdentifier

In case of bug report: Steps to reproduce the problem

1. This is the content of my unit. Store it in ss-server.service.

[Unit]
Description=Shadowsocks-Libev Server Service
Documentation=man:ss-server(1)
After=network.target

[Service]
SyslogIdentifier=ssserver
StandardOutput=syslog
StandardError=syslog
Type=simple
User=shadowsocks
Group=shadowsocks
UMask=0027
CapabilityBoundingSet=CAP_NET_BIND_SERVICE
PIDFile=/run/shadowsocks-libev/ss-server.pid
PermissionsStartOnly=true
ExecStartPre=/bin/mkdir -p /run/shadowsocks-libev
ExecStartPre=/bin/chown shadowsocks:shadowsocks /run/shadowsocks-libev
ExecStart=/usr/local/bin/ss-server -f /var/run/shadowsocks-libev/ss-server.pid -c /etc/shadowsocks-libev/config.json
Restart=always
RestartSec=3

[Install]
WantedBy=multi-user.target

2. Start the service.

sudo systemctl enable ss-server
sudo systemctl start ss-server

3. View the log with journalctl

sudo journalctl --unit ss-server -o verbose

[poettering]

Did you read the manual about this option? My educated guess is that you are expecting this setting to have an effect on log messages written via the syslog() protocol, right? But that's not what this is, and that's explicitly documented: it only affects logging done through the daemon process' stdout/stderr stream, i.e. the mode where systemd/journald will automatically turn stdout/stderr logging into proper log records, and for that need to come up with a syslog identifier field which you can configure this way.

To figure out how a log record was passed to journald you can look for the _TRANSPORT= structured log field of the record. Use "journalctl -o verbose" to get a look at it. What is it set to for the log message you care about?

[awakenrz]

Thank you for explanation!

I looked at the code of the service. The service indeed directly writes to syslog instead of stdout/stderr. So it's working as intended that SyslogIdentifier is not affecting SYSLOG_IDENTIFIER for the log entries for my service in journalctl.