title: How to configure rsyslog for use with SysLogHandler logging class?
body: <p>In order to write log messages of "myapp" into <code>/var/log/local5.log</code>, I use <a href="https://docs.python.org/3/library/logging.handlers.html#sysloghandler" rel="nofollow">SysLogHandler</a>.</p>
  
  <h3>problem</h3>
  
  <p>"myapp" runs well, no error, but nothing gets logged, <code>/var/log/local5.log</code> remains empty.</p>
  
  <h3>logging configuration</h3>
  
  <p>Relevant parts of the logging configuration file:</p>
  
  <pre><code>handlers:
      mainHandler:
          class: logging.handlers.SysLogHandler
          level: INFO
          formatter: defaultFormatter
          address: '/dev/log'
          facility: 'local5'
  
  loggers:
      __main__:
          level: INFO
          handlers: [mainHandler]
  </code></pre>
  
  <h3>logging test</h3>
  
  <p>Here is how I try to write a log in the main script of "myapp":</p>
  
  <pre><code>with open('myconfig.yml') as f:
      logging.config.dictConfig(yaml.load(f))
  
  log = logging.getLogger(__name__)
  log.info("Starting")
  </code></pre>
  
  <p>I have added some <code>sys.stderr.write()</code> to <code>/usr/lib/python3.4/logging/handlers.py</code> to see what's happening and I get:</p>
  
  <pre><code>$ myapp
  [SysLogHandler._connect_unixsocket()] Sucessfully connected to socket: /dev/log
  [SysLogHandler.emit()] called
  [SysLogHandler.emit()] msg=b'&lt;174&gt;2016/04/23 07:17:00.453 myapp: main: Starting\x00'
  [SysLogHandler.emit()] msg sent to unix socket (no OSError)
  </code></pre>
  
  <h3>rsyslog configuration</h3>
  
  <ul>
  <li><p><code>/etc/rsyslog.conf</code> (relevant parts; TCP and UDP syslog receptions are disabled):</p>
  
  <pre><code>$ModLoad imuxsock # provides support for local system logging
  $ModLoad imklog   # provides kernel logging support
  
  [...]
  
  $IncludeConfig /etc/rsyslog.d/*.conf
  </code></pre></li>
  <li><p><code>/etc/rsyslog.d/40-local.conf</code>:</p>
  
  <pre><code>local5.*                        /var/log/local5.log
  </code></pre></li>
  </ul>
  
  <h3>rsyslog test</h3>
  
  <p>According to <code>lsof</code> output, it looks like <code>rsyslogd</code> is listening to <code>/dev/log</code> (or am I wrong?):</p>
  
  <pre><code># lsof | grep "/dev/log"
  lsof: WARNING: can't stat() fuse.gvfsd-fuse file system /run/user/1000/gvfs
        Output information may be incomplete.
  rsyslogd  28044           syslog    0u     unix 0xffff8800b4b9b100       0t0    3088160 /dev/log
  in:imuxso 28044 28045     syslog    0u     unix 0xffff8800b4b9b100       0t0    3088160 /dev/log
  in:imklog 28044 28046     syslog    0u     unix 0xffff8800b4b9b100       0t0    3088160 /dev/log
  rs:main   28044 28047     syslog    0u     unix 0xffff8800b4b9b100       0t0    3088160 /dev/log
  </code></pre>
  
  <p>I don't put the whole <code>rsyslogd -N1</code> output since it's a bit long, but the mentionning"local" lines:</p>
  
  <pre><code># rsyslogd -N1 | grep local
  rsyslogd: version 7.4.4, config validation run (level 1), master config /etc/rsyslog.conf
  3119.943361369:7f39080fc780: cnf:global:cfsysline: $ModLoad imuxsock # provides support for local system logging
  3119.944034769:7f39080fc780: rsyslog/glbl: using '127.0.0.1' as localhost IP
  3119.946084095:7f39080fc780: requested to include config file '/etc/rsyslog.d/40-local.conf'
  3119.946135638:7f39080fc780: config parser: pushed file /etc/rsyslog.d/40-local.conf on top of stack
  3119.946432390:7f39080fc780: config parser: resume parsing of file /etc/rsyslog.d/40-local.conf at line 1
  3119.946678298:7f39080fc780: config parser: reached end of file /etc/rsyslog.d/40-local.conf
  3119.946697644:7f39080fc780: Decoding traditional PRI filter 'local5.*'
  3119.946723904:7f39080fc780: symbolic name: local5 ==&gt; 168
  3119.949560475:7f39080fc780: PRIFILT 'local5.*'
  3119.949675782:7f39080fc780:   ACTION 0x224cda0 [builtin:omfile:/var/log/local5.log]
  3119.953397587:7f39080fc780: PRIFILT 'local5.*'
  3119.953806713:7f39080fc780:   ACTION 0x224cda0 [builtin:omfile:/var/log/local5.log]
  rsyslogd: End of config validation run. Bye.
  </code></pre>
  
  <p>I don't understand what I am missing. <a href="http://www.rsyslog.com/doc/v7-stable/#manual" rel="nofollow">rsyslog's documentation</a> matching the version I use (7.4.4) seems outdated and I can't find my way in it. Not sure that's the place to find how to fix my problem.</p>
  
  <p>EDITS:</p>
  
  <ul>
  <li>It's not possible to define a "personal" facility, like "myapp" (even if it's defined in <code>rsyslog.conf</code>, so I changed to use the 'local5' one.</li>
  </ul>