Comment # 1 on bug 991190 from Dr. Werner Fink

man:systemd-journald(8)

       /dev/kmsg, /dev/log, /run/systemd/journal/dev-log,
       /run/systemd/journal/socket, /run/systemd/journal/stdout
           Sockets and other paths that systemd-journald will listen on
           that are visible in the file system. In addition to these,
           journald can listen for audit events using netlink.