(In reply to Thorsten Kukuk from comment #5) > (In reply to Thomas Blume from comment #4) > > So, maybe apparmor needs to be reconfigured (on my reference machine there > > is no apparmor installed). > > Can I disable apparmarmor and reboot your machine to double check? > > Yes I was wrong, this has nothing to do with apparmor. The configuration issue is in: /etc/systemd/journald.conf that defaults to: #ForwardToSyslog=no as soon as I set: ForwardToSyslog=yes and restart journald, it works correctly. That matches the documentation in the journald.conf manpage. On SLES it defaults to ForwardToSyslog=yes, that's why it works there out of the box. The interesting question is why it worked on my reference Tumbleweed machine, even though it also defaults to ForwardToSyslog=no. But that might not be of interest for you.