Dear Maintainer,

The Debian syslog-ng package is not collecting all systemd-journal messages.

The use case that caused me to track this down is an inconsistency between the
Debian syslog-ng and rsyslog packages when logging Knot DNS activity (using
the 'knot' package from upstream https://deb.knot-dns.cz/knot-latest/).

A default install of rsyslog captures Knot's logging activity to
/var/log/user.log, while a default install of syslog-ng does not capture its
activity at all.  The default syslog-ng configuration should log the same
messages to /var/log/user.log, but it seems syslog-ng doesn't even see the
log messages.

Digging a bit deeper .. journald.conf(5) indicates that syslog messages are
written to /run/systemd/journal/syslog.  I noted that syslog-ng does not
create this socket, while rsyslog does.

There is a comment in syslog.socket which indicates a syslog daemon is
expected to include "Alias=syslog.service" in its [install] section in order
to pull in this dependency.  The rsyslog package does this, but the syslog-ng
package does not.  It seems likely this is related to the issues with
capturing syslog messages.