The vendor drop-in /usr/lib/systemd/journald.conf.d/syslog.conf ships ForwardToSyslog=yes to support rsyslog on default Debian installations. This was added to undo upstream commit 46b131574fdd7d77 which changed the compiled default from yes to no.

Two issues:

1. rsyslog was demoted from Priority: important to optional in Bookworm. A default Debian installation no longer includes rsyslog, so this drop-in re-enables forwarding to a socket that nothing listens on.

2. The filename has no numeric prefix. Per systemd.unit(5), vendor drop-ins should use the 10-40 range. Because 's' sorts after all digits in ASCII, an administrator cannot override this file using the 60-80 range intended for local configuration. The available workarounds are either shadowing by placing a file with the identical name in /etc/systemd/journald.conf.d/, or naming the override with a filename that sorts lexicographically after 's'. Both force the administrator out of the documented numeric prefix convention, defeating its purpose.

Suggested resolution: remove the drop-in entirely, or at minimum rename it to a 20- or 30- prefixed filename so that administrator overrides in the 60-80 range take effect as designed.