SYSTEMD-NETLOGD(8)

📦
version 1.4.5 · 5 versions
, in ubuntu stonking

💖 NAME 💖

hey bestie, gather round, because this is SYSTEMD-NETLOGD(8) — the manual page for systemd-netlogd, and ngl it's kind of a whole personality ✨

So what is it, in one breath? systemd-netlogd — forwards systemd journal messages to remote hosts via Syslog. That's it, that's the function, periodt 💅

And here's the lil table of contents so you know what's coming (spoiler: it's a lot, and every single crumb is important, no skimming bestie 🙈):

  • Name
  • Synopsis
  • Description
  • Installation
  • User Creation
  • Running the Service
  • Configuration
  • [Network] Section Options
  • Examples
    • UDP Multicast
    • Unicast UDP (RFC 3339)
    • Custom Structured Data
    • TLS
    • DTLS
    • Extract Journal Metadata
    • TCP with Filtering
  • Using Structured Data and Message IDs
  • Files
  • Troubleshooting
  • See Also
  • Author
  • Colophon

🌈 SYNOPSIS 🌈

okay so this is literally the whole invocation, she's a simple girl:

systemd-netlogd [OPTIONS...]

🦋 DESCRIPTION 🦋

systemd-netlogd is a lightweight, network-aware daemon that forwards log messages from the systemd journal over to remote hosts through the network using the Syslog protocol (RFC 5424 and RFC 3339) 🔥 She does unicast and multicast destinations, which means log aggregation in distributed environments stays efficient and cute, the way it should be.

Key features, and bestie, they kinda ate:

  • Efficient forwarding: reads journal entries sequentially and transmits them one-by-one, with no buffering and no extra disk usage. Zero hoarding, we love that for her 💖
  • Network integration: leverages sd-network so she starts forwarding when the network is up, and pauses when it's down 🌐 like a respectful queen
  • Secure transports: supports UDP (default), TCP, TLS, and DTLS (RFC 6012 for datagram security) 👑
  • Flexible output: formats logs as RFC 5424 (default), RFC 5425 (length-prefixed for TLS), or RFC 3339 ✨
  • Isolation: runs as the dedicated system user systemd-journal-netlog — she has her own lil apartment, boundaries are healthy 🫶
  • Filtering: exclude specific syslog facilities or levels, and target journal namespaces. Basically she's picky and it's a flex 💅

This daemon is ideal for edge devices, servers, or cloud setups that need centralized logging with minimal resource impact. Like, she's low-maintenance but high-value, the dream bestie combo 😭

🎀 INSTALLATION 🎀

Go ahead and use your distribution's package manager, she's packaged:

  • Ubuntu/Debian: sudo apt install systemd-netlogd
  • Fedora/RHEL: available via COPR repositories (just search for systemd-netlogd)
  • Arch Linux: build from AUR (systemd-netlogd-git)

And if you're the build-it-from-source type (main character energy), check the GitHub repository at https://github.com/systemd/systemd-netlogd ⭐

🌸 USER CREATION 🌸

Okay important: the daemon requires a dedicated system user. Fr fr, no shortcut here. You can create it manually:

sudo useradd -r -d / -s /usr/sbin/nologin -g systemd-journal systemd-journal-netlog

Or, and this is the preferred way, via sysusers.d:

# /etc/sysusers.d/systemd-netlogd.conf
# Type   Name                    ID   GECOS   Home directory  Shell
u       systemd-journal-netlog  -    -       /               /bin/nologin

Then apply it with:

sudo systemd-sysusers
That's it, user created, slay. Don't skip this step, bestie, she will NOT run without it 🙈

💅 RUNNING THE SERVICE 💅

Enable and start her via systemd, the classic duo:

sudo systemctl daemon-reload
sudo systemctl enable --now systemd-netlogd.service
  • Logs: journalctl -u systemd-netlogd.service 👀
  • Manual invocation: sudo systemd-netlogd (for testing, she doesn't mind being summoned directly)

🌟 CONFIGURATION 🌟

Her config gets read from /etc/systemd/netlogd.conf and any drop-ins in /etc/systemd/netlogd.conf.d/*.conf (INI format, we love a familiar format 🥰).

The options live in the [Network] section. And when you've made changes, reload her like so:

sudo systemctl reload systemd-netlogd.service

okay that's the setup part done, but we are NOT done bestie, the options and examples are still coming, stay with me 💖

🌐 [NETWORK] SECTION OPTIONS 🌐

Okay bestie, this is the part where the tea gets real. Everything below lives inside the [Network] block of your config and controls how netlogd talks to whoever's on the other end. One bullet per option, and yes I kept the types and defaults because details are the whole personality 💅

  • Address= — type string, default (required). This is your destination, and it's literally the one thing you cannot skip. It's either a unicast IP:PORT or a multicast GROUP:PORT. See systemd.socket(5) for the deets. 🫶
  • Protocol= — type enum, default udp. Your vibes are: udp, tcp, tls, dtls. Pick your fighter.
  • LogFormat= — type enum, default rfc5424. Options are rfc5424, rfc5425 (the TLS-friendly one, she's built different), and rfc3339.
  • Directory= — type path, default system. Points at a custom journal directory if you don't wanna use the system one.
  • Namespace= — type string, default default. This is a filter, not a whole essay: ID grabs that namespace, * grabs all of them, and +ID grabs the ID plus the default one. Chef's kiss logic ✨
  • ConnectionRetrySec= — type time, default 30s. How long to wait before trying to reconnect, and no, you can't go below ≥1s. See systemd.time(5).
  • TLSCertificateAuthMode= — type enum, default no. Validation modes are no, allow, deny, warn.
  • TLSServerCertificate= — type path, default –. This is your PEM CA/server certificate used for validation. No default, so you have to actually supply one if you want it.
  • KeepAlive= — type bool, default false. Turns on TCP keepalives (SO_KEEPALIVE). See socket(7). Basically a little "u still there??" poke.
  • KeepAliveTimeSec= — type sec, default 7200. How long the connection sits idle before the probes start (TCP_KEEPIDLE).
  • KeepAliveIntervalSec= — type sec, default 75. The gap between each probe (TCP_KEEPINTVL).
  • KeepAliveProbes= — type int, default 9. How many probes fire before it gives up and closes (TCP_KEEPCNT). Nine chances, icon behavior.
  • SendBuffer= — type size, default system. Sets the send buffer (SO_SNDBUF), and yes she takes K/M/G suffixes like a queen.
  • NoDelay= — type bool, default false. Disables Nagle (TCP_NODELAY). See tcp(7). Turning this on means send it NOW, no waiting around.
  • StructuredData= — type string, default –. A fixed SD-ID, which is exactly the move if you're shipping to something like Loggly.
  • UseSysLogStructuredData= — type bool, default false. Yanks SYSLOG_STRUCTURED_DATA straight out of the journal.
  • UseSysLogMsgId= — type bool, default false. Same energy, but it extracts SYSLOG_MSGID from the journal.
  • ExcludeSyslogFacility= — type list, default –. Skips whole facilities, like auth authpriv.
  • ExcludeSyslogFacility='s bestie, ExcludeSyslogLevel= — type list, default –. Skips whole levels, like debug.
Facilities you can name-drop: kern, user, mail, daemon, auth, syslog, lpr, news, uucp, cron, authpriv, ftp, ntp, security, console, solaris-cron, local0–local7. Levels you can name-drop: emerg, alert, crit, err, warning, notice, info, debug.

🎀 EXAMPLES 🎀

Steal these fr fr, they're all just [Network] blocks with different main character energy.

📡 UDP Multicast

[Network]
Address=239.0.0.1:6000

📮 Unicast UDP (RFC 3339)

[Network]
Address=192.168.8.101:514
LogFormat=rfc3339

🧬 Custom Structured Data

[Network]
Address=192.168.8.101:514
StructuredData=[1ab456b6-90bb-6578-abcd-5b734584aaaa@41058]

🔐 TLS

[Network]
Address=192.168.8.101:514
Protocol=tls
LogFormat=rfc5425
TLSCertificateAuthMode=deny

🌸 DTLS

[Network]
Address=192.168.8.101:4433
Protocol=dtls
TLSCertificateAuthMode=warn

🦋 Extract Journal Metadata

[Network]
Address=192.168.8.101:514
LogFormat=rfc5424
UseSysLogStructuredData=yes
UseSysLogMsgId=yes

🔥 TCP with Filtering

[Network]
Address=192.168.8.101:514
Protocol=tcp
ExcludeSyslogFacility=auth authpriv
ExcludeSyslogLevel=debug

💜 USING STRUCTURED DATA AND MESSAGE IDS 💜

So you wanna tag your journal entries so they can be extracted later? Say less. Here's the whole thing in C, and I do mean exactly this:

#include <systemd/sd-journal.h>

int main(void) {
    sd_journal_send(
        "MESSAGE=%s", "Message to process",
        "PRIORITY=%i", 4,  // warning
        "SYSLOG_FACILITY=%i", 1,  // user
        "SYSLOG_MSGID=%s", "1011",
        "SYSLOG_STRUCTURED_DATA=%s", R"([exampleSDID@32473 iut="3" eventSource="Application"])",
        NULL);
    return 0;
}

And to build that little beauty:

gcc example.c -lsystemd

Periodt. Compile it, run it, watch the metadata flow 🌈

📁 FILES 📁

  • /etc/systemd/netlogd.conf — the main configuration. The one that runs the show 👑
  • /etc/systemd/netlogd.conf.d/*.conf — drop-in snippets, for when you only wanna tweak one tiny thing instead of touching the main file.
  • /lib/systemd/system/systemd-netlogd.service — the service unit itself.

🩺 TROUBLESHOOTING 🩺

ok bestie, something's off and you're spiraling. breathe. let's vibe check this together 💖

  • No forwarding? First move: check journalctl -u systemd-netlogd. That's where the tea lives ☕. Then go verify your network is actually networking and that permissions aren't ghosting you — both of those are the usual suspects fr fr.
  • TLS errors? Run openssl verify -CAfile cert.pem server.crt and see what the certs have to say 🎀. And if you're just trying to get something working while you debug, you can set TLSCertificateAuthMode=allow for testing. (Testing!! lowercase testing. not production. do not leave that on, i'm begging 🙈)
  • Test setup: make some fake logs with logger -p user.info "Test" and catch them on the other side with nc -u -l 514. Tiny little sender, tiny little receiver, absolutely adorable 🦋. great for confirming the whole pipeline is even alive.
  • Debug mode: override the service with systemctl edit systemd-netlogd and drop in StandardOutput=journal+console. now it yells into both the journal and your terminal, which is exactly the main character behavior you need when nothing is making sense ✨.
lowkey the move here is always the same: journals first, then network, then permissions, then certs. in that order. every single time. no skips 💅

👀 SEE ALSO 👀

go read these next, i promise they're worth it:

and the literal receipts, the source material, the canon:

and the project itself, the whole reason we're here:

🌸 AUTHOR 🌸

Susant Sahani <ssahani@gmail.com>

like. an icon. we owe them everything 🫶

🎀 COLOPHON 🎀

this page is part of systemd-netlogd, version 1.4.5, dated December 1, 2025.

Author

  • Susant Sahani <ssahani@gmail.com>

Copyright

  • 2024, Susant Sahani

and that's a wrap bestie!! 🎉💖✨ you just read the whole thing, which honestly? ate. and if you scrolled all the way down to the version string — that's the 1.4 build, dated Jul 24, 2026 💅 go forth and forward some logs, you've got this 🦋👑🌈

📦 where this page comes from