On RHEL7, systemd-journald takes over many of the responsibilites of what was once done by rsyslogd. Whether by bug or conflict between these two daemons, sometimes /dev/log will go missing. As a result, programs relying on the syslog(3) call will not function properly, including, for instance, logger. How can I restore the /dev/log socket?
How do I restore `/dev/log` in systemd+rsyslog host?
journald;rsyslogd
Asking and answering my own question because Google was not very helpful on this one. Normally, with rsyslogd, the imuxsock module will create the /dev/log socket on its own, unlinking the previous entry before creating it. When rsyslogd is stopped (possibly because restart which fails because of faulty configuration), rsyslogd removes /dev/log. However, the rsyslog supplied with RHEL7 is expected to be used in conjunction with systemd, and the imuxsock module will actually open and remove /run/systemd/journal/syslog socket. Meanwhile, the /dev/log device is created by the system service-file systemd-journald.socket which triggers journald. Apparently, whether or not $imjournal module is used, the following works.In sum, if /dev/log disappears:restart systemd-journald.socket:systemctl restart systemd-journald.socketthen restart rsyslogdsystemctl start rsyslogdUPDATE: I believe restart rsyslogd might re-delete the socket if rsyslogd is already running.