systemd-netlogd is a lightweight, battle-tested daemon that forwards systemd journal logs to remote hosts over the network using the Syslog protocol (RFC 5424 & RFC 3339).
It supports unicast and multicast, with zero disk buffering — perfect for edge devices, servers, and cloud fleets.

Ideal for: Centralized logging without local storage impact

Requires systemd v255+ for full features.

sudo apt update
sudo apt install build-essential gperf libcap-dev libsystemd-dev pkg-config meson python3-sphinx

sudo dnf group install 'Development Tools'
sudo dnf install gperf libcap-devel pkg-config systemd-devel meson python3-sphinx

git clone https://github.com/systemd/systemd-netlogd.git
cd systemd-netlogd
meson setup build
meson compile -C build
sudo meson install -C build

Tip: Prefer meson. make still works but is legacy.

# Copy provided file or create:
sudo tee /etc/sysusers.d/systemd-netlogd.conf > /dev/null <<EOF
u systemd-journal-netlog - - / /bin/nologin
EOF
sudo systemd-sysusers

sudo useradd -r -d / -s /usr/sbin/nologin -g systemd-journal systemd-journal-netlog

sudo systemctl daemon-reload
sudo systemctl enable --now systemd-netlogd.service

Check logs:

journalctl -u systemd-netlogd.service -f

Manual test:

SYSTEMD_LOG_LEVEL=debug /usr/lib/systemd-netlogd 

Config: /etc/systemd/netlogd.conf
Drop-ins: /etc/systemd/netlogd.conf.d/*.conf (INI format)

Reload: sudo systemctl reload systemd-netlogd.service

[Network]
Address=239.0.0.1:6000
# Protocol=udp (default)

[Network]
Address=192.168.1.100:514
LogFormat=rfc3339

[Network]
Address=logs.papertrailapp.com:12345
LogFormat=rfc5424
StructuredData=[1ab456b6-90bb-6578-abcd-5b734584aaaa@41058]

[Network]
Address=192.168.1.100:514
LogFormat=rfc5424
UseSysLogStructuredData=yes
UseSysLogMsgId=yes

[Network]
Address=192.168.1.100:514
ExcludeSyslogFacility=auth,authpriv
ExcludeSyslogLevel=debug

[Network]
Address=secure-logger.example.com:6514
Protocol=tls
LogFormat=rfc5424
TLSCertificateAuthMode=deny
TLSServerCertificate=/etc/ssl/ca-bundle.pem
KeepAlive=true
NoDelay=true

[Network]
Address=192.168.1.100:4433
Protocol=dtls
TLSCertificateAuthMode=allow

#include <systemd/sd-journal.h>

int main() {
    sd_journal_send(
        "MESSAGE=Login attempt",
        "PRIORITY=4",
        "SYSLOG_FACILITY=10",  // authpriv
        "SYSLOG_MSGID=LOGIN001",
        "SYSLOG_STRUCTURED_DATA=[auth@12345 user=\"alice\" ip=\"1.2.3.4\" result=\"success\"]",
        NULL
    );
    return 0;
}

Compile:

gcc tag.c -lsystemd -o tag && ./tag

1. Fork it
2. Create your feature branch
3. Commit with clear messages
4. Open a PR!

See CONTRIBUTING.md

LGPL-2.1-or-later — same as systemd.
See LICENSE.

Questions? Open an issue on GitHub!
Star this repo if you love centralized logging!