bindage from the osdev discord proposes these as the top 3 use cases for service logging:

1. Why is this service broken?
2. Why is the system not working right?
3. Tell me when something goes wrong.

I am thinking to make a simple module host as the basis of our Event Manager. It will play host to input modules, implementing means by which events can be submitted (e.g. journald's native /run/systemd/journal/socket datagram socket), and to output modules, implementing means to store the logs on disk. In the middle, we might keep some ring buffers of a few lines of each service's output, and provide that on demand to offer per-service lastlog functionality.

Troubles here:

• How do we know what service a message came from?
  • For services launched from the InitWare manager, we can set up a stream socket in advance and make it the stdout of our service. The stream socket can be made so that only root may connect to it; the InitWare manager is then responsible to connect and provide details on the service.
  • We can use SCM_CREDS or equivalent for what we receive on the datagram socket (except on OpenBSD until they add this functionality) but we'd need to communicate with the InitWare manager to determine the ptgroup (and thus unit) to which the PID belongs. Imposes some undesirable vendor-lock in; I'd rather our event manager not depend on the system being managed by InitWare.

I love this project. Will be contributing soon.