diff --git a/src/api2/node.rs b/src/api2/node.rs
index a19bea7e..6c3e7967 100644
--- a/src/api2/node.rs
+++ b/src/api2/node.rs
@@ -34,7 +34,7 @@ pub mod subscription;
 pub(crate) mod rrd;
 
 mod journal;
-mod services;
+pub(crate) mod services;
 mod status;
 mod syslog;
 mod time;
diff --git a/src/api2/node/services.rs b/src/api2/node/services.rs
index 4c2a17b4..40520208 100644
--- a/src/api2/node/services.rs
+++ b/src/api2/node/services.rs
@@ -22,7 +22,7 @@ static SERVICE_NAME_LIST: [&str; 7] = [
     "systemd-timesyncd",
 ];
 
-fn real_service_name(service: &str) -> &str {
+pub fn real_service_name(service: &str) -> &str {
 
     // since postfix package 3.1.0-3.1 the postfix unit is only here
     // to manage subinstances, of which the default is called "-".
diff --git a/src/api2/node/syslog.rs b/src/api2/node/syslog.rs
index 28a79469..56662805 100644
--- a/src/api2/node/syslog.rs
+++ b/src/api2/node/syslog.rs
@@ -134,12 +134,18 @@ fn get_syslog(
     mut rpcenv: &mut dyn RpcEnvironment,
 ) -> Result<Value, Error> {
 
+    let service = if let Some(service) = param["service"].as_str() {
+        Some(crate::api2::node::services::real_service_name(service))
+    } else {
+        None
+    };
+
     let (count, lines) = dump_journal(
         param["start"].as_u64(),
         param["limit"].as_u64(),
         param["since"].as_str(),
         param["until"].as_str(),
-        param["service"].as_str())?;
+        service)?;
 
     rpcenv["total"] = Value::from(count);