On 10/14/2015 07:09 AM, C.L. Martinez wrote: > Uhmm ... that is not what I expect: > > lsof: WARNING: can't stat() fuse.gvfsd-fuse file system > /run/user/1000/gvfs > Output information may be incomplete. > COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME > systemd 1 root 27u unix 0xffff880250ea0f00 0t0 1436 /dev/log > systemd-j 263 root 5u unix 0xffff880250ea0f00 0t0 1436 /dev/log So, the obvious next step is to make sure journald isn't holding that socket. That's outside my experience, but I'd imagine that you can: systemctl disable systemd-journald.service systemctl stop systemd-journald.service Then you'll need to restart rsyslog and verify that it owns /dev/log. > In theory, rsyslog is listenning to uxsock and imjournal: Only one process can have a socket open at a time. Since journald holds /dev/log, rsyslog can't, which is why your cron log is empty. > #### MODULES #### > # The imjournal module bellow is now used as a message source instead > of imuxsock. > $ModLoad imuxsock # provides support for local system logging (e.g. > via logger command) > $ModLoad imjournal # provides access to the systemd journal There's no real point in using imjournal if journald isn't running.