Skip to main content

syslogd not working

darwin7
Good morning I received an lfd message ("SYSLOG Check Failed") reporting that syslog is not working properly. I checked the service and it seem running and working: [quote]root@iris [~] # service rsyslog status Redirecting to /bin/systemctl status rsyslog.service ? rsyslog.service - System Logging Service Loaded: loaded (/usr/lib/systemd/system/rsyslog.service; enabled; vendor preset: enabled) Active: active (running) since Mon 2018-12-10 09:25:41 CET; 3min 4s ago Main PID: 595937 (rsyslogd) CGroup: /system.slice/rsyslog.service ??595937 /usr/sbin/rsyslogd -n
I also tried to manually add an entry: [quote] root@iris [~] # logger -p auth.notice "log test" root@iris [~] # grep "log test" /var/log/messages root@iris [~] #
...but I had nothing in return. Then, I've seen that /var/log/messages is empty. Not sure that this is normal. Finally: 1) the server is a newly setup server. syslog never worked well on this machine 2) checked /etc/rsyslog.conf and verified that it is identical to same file (/etc/rsyslog.conf) on other servers. Please, what can I do? Thank you

Comments

12 comments

Date Votes
  • cPanelLauren
    Hi @darwin7 While I do want to point out that this question is more geared towards a system administrator. I'd like to see if it's a simple fix. Can you show me what the following two lines look like in /etc/ryslog.conf? $ModLoad imuxsock # provides support for local system logging (e.g. via logger command) $ModLoad imjournal # provides access to the systemd journal
    You can find this easily by running the following: [root@server dynamicui]# egrep 'imuxsock|imjournal' /etc/rsyslog.conf |grep ModLoad $ModLoad imuxsock # provides support for local system logging (e.g. via logger command) $ModLoad imjournal # provides access to the systemd journal
    0
  • darwin7
    Hi @cPanelLauren no longer need to check, because yesterday rsyslog started to work normally. I investigated further, but unfortunately I was unable to understand what happened and why it fixed itself after >10 days of problems. Thank you for your help :)
    0
  • cPanelLauren
    Hi @darwin7 That's odd! I'm glad it's working as intended now, thanks for letting us know. If you do run into any further issues with it let us know and we'll help as best we can. Thanks!
    0
  • IMH-2018
    Hi I am facing a similar issue. service rsyslog is running but /var/log/messages and /var/log/maillog not writing Please help
    0
  • cPanelLauren
    Hello @IMH-2018 Does it begin writing to messages or maillog if you restart it? What OS are you running? What is the output of the following: [root@server dynamicui]# egrep 'imuxsock|imjournal' /etc/rsyslog.conf |grep ModLoad $ModLoad imuxsock # provides support for local system logging (e.g. via logger command) $ModLoad imjournal # provides access to the systemd journal
    0
  • IMH-2018
    Hello, I didnt try restarting the server. I am using Cloudlinux release 7.6 And the output..... 58883 are there any new update to resolve this issue
    0
  • cPanelLauren
    You wouldn't want to restart the server for this just the process which you can do with the following: /scripts/restartsrv_rsyslog
    0
  • Major Tom
    I have the same issue for quite a while now (WHM 82.0.16 centos 7.7), however rebooting is of no use. I have the required entries in rsyslog.conf. Actually I have managed to kind of solve the issue by commenting out $OmitLocalLogging on and was wondering what the drawbacks are of leaving this fix in place. I have tried no end of solutions to get rsyslog to pull entries from the journal, including restarts of all related services, erasing the rsyslog state file, rotating the journal files and turning compress off which I was hoping would fix the file corruption that 'journalctl --verify' finds in the current journald file ("entry timestamp out of synchronization"). Journald works fine and displays logs regardless of the corruption issue but rsyslog cannot pull entries from it. Even if I erase or vacuum the current journald file, corruption reappears in the new file yet journald works fine and picks up logger command tests. Nothing appears in any of the files stated in the rsyslog configuration (messages, maillog etc).
    0
  • cPanelLauren
    Can you please open a ticket using the link in my signature? Once open please reply with the Ticket ID here so that we can update this thread with the resolution once the ticket is resolved. Thanks!
    0
  • Major Tom
    Thank you for your reply, I cannot follow that solution because of the license-type. As far as I understand it, I should be helped by the reseller but they are unhelpful.
    0
  • cPanelLauren
    If you have root-level access and you're unable to receive assistance from your provider you can still open a ticket with us. We do recommend you contact your provider first and we note that when you're opening the ticket but you can move past that screen.
    0
  • Mike Blue
    • Edited

    It seems like your syslog service is running, but there might be an issue with the configuration or the syslog messages are not being directed to the expected location. Here are a few steps you can take to troubleshoot and resolve the issue:

    1. Check Configuration Files: Verify the configuration files for rsyslog. You mentioned that /etc/rsyslog.conf is identical to other servers, but check it again for any potential issues. Also, ensure that there are no syntax errors in the configuration.

    2. Check Log Paths: Ensure that the log paths specified in the configuration file are correct. Sometimes, syslog messages might be sent to a different location.

    3. Verify Disk Space: Check if there is sufficient disk space on the partition where syslog is configured to store log files. If the partition is full, syslog might fail to write logs.

    4. Check SELinux/AppArmor: If your server is using SELinux (Security-Enhanced Linux) or AppArmor, they might be preventing syslog from writing to the expected locations. Check the logs related to SELinux or AppArmor for any denial messages.

    5. Restart syslog: After making changes to the configuration, restart the syslog service to apply the changes.

      systemctl restart rsyslog

    6. Review Systemd Journal: Check the systemd journal for any syslog-related messages.

      journalctl -xe | grep syslog

    7. Permissions: Ensure that the syslog process has the necessary permissions to write to the log files and directories specified in the configuration.

    8. Logging Levels: Make sure that the logging level in the configuration is set appropriately. If it's set to a high level, some messages might be excluded.

    9. Test with logger: Instead of just testing with logger -p auth.notice "log test", try a broader log level, and check if it appears in the logs.

    I stumbled upon Sistrix Alternatives that have elevated my SEO game. The robust features and user-friendly interfaces empower marketers. The insightful analytics and comprehensive tools make optimizing websites a breeze. A must-visit resource for marketers seeking efficient and effective SEO solutions!

    0

Please sign in to leave a comment.

Didn't find what you were looking for?

New post