(In reply to Thorsten Kukuk from comment #8) > The fix is quite simple for this: > > rsyslog provides a journald.d.conf/rsyslog.conf file, which enables > ForwardToSyslog. > No need to differentiate in the sources if this is openSUSE or SLE: in case > rsyslog is installed, forward the messages. You are fast. :) I was investigating another approach where pulls directly from the journal: https://www.rsyslog.com/doc/v8-stable/configuration/modules/imjournal.html but it seems this method has some drawbacks. Let's use the proven method then.