CSF reports that SYSLOG may not be logging correctly

Please note that Way to the Web Ltd. (the company behind ConfigServer) has announced it will close permanently on August 31, 2025. However, their free scripts will remain available under the GPLv3 license. For more details, see:

ConfigServer Services Announcement

Symptoms

You receive an email containing an error similar to the following.

Error: Failed to detect code [kxL3RW53YXXGN7S] in SYSLOG_LOG [/var/log/messages]

Description

The error occurs when CSF doesn't detect an expected message in the system log file. There are various reasons for this, such as the rsyslog or systemd-journald service not running, rate limiting for the system log, or the system log file not being present or set to immutable. The system administrator should resolve the underlying cause. However, the CSF's syslog check can be disabled to prevent the messages from being generated.

Procedure

1. Access the server's command line as the 'root' user via SSH or "Terminal" in WHM.
2. Open /etc/csf/csf.conf in your preferred text editor.
3. Locate the SYSLOG_CHECK entry.
4. Set SYSLOG_CHECK to 0.

   SYSLOG_CHECK = "0"

5. Save the changes and exit the text editor.
6. Restart CSF.

   csf -r

Please note that cPanel doesn't provide or install CSF. CSF is developed and supported by ConfigServer.

ConfigServer Community Forum: General Discussion (csf)