1

I'm not sure what I'm doing wrong, but my Linux box doesn't seem to be logging any info to the /var/log/messages file.

I've also checked and the kernel isn't logging anything either.

My syslog version is: rsyslog-5.8.10-10.el6_6.x86_64 and I've checked in /etc/rsyslog.d which contains nothing. I've never seen it log anything (as indicated by the directory listing below) and I've confirmed the process is running on the server.

My /etc/rsyslog.conf file (Without comments):

#### MODULES ####
$ModLoad imuxsock # provides support for local system logging (e.g. via logger command)
$ModLoad imklog   # provides kernel logging support (previously done by rklogd)

#### GLOBAL DIRECTIVES ####
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

$IncludeConfig /etc/rsyslog.d/*.conf

#### RULES ####
kern.*                                                  /var/log/kernel

*.info;mail.none;authpriv.none;cron.none;dhclient.none                /var/log/messages

authpriv.*                                              /var/log/secure

mail.*                                                  -/var/log/maillog

cron.*                                                  /var/log/cron

*.emerg                                                 *

uucp,news.crit                                          /var/log/spooler

local7.*                                                /var/log/boot.log

And here's the ps info:

[root@ip-172-31-29-157 log]# ps ax | grep syslog
11821 ?        Sl     0:00 /sbin/rsyslogd -i /var/run/syslogd.pid -c 5
12336 pts/0    S+     0:00 grep syslog

Some sys info:

[root@ip-172-31-29-157 log]# cat /proc/version
Linux version 2.6.32-642.el6.x86_64 (mockbuild@worker1.bsys.centos.org) (gcc version 4.4.7 20120313 (Red Hat 4.4.7-17) (GCC) ) #1 SMP Tue May 10 17:27:01 UTC 2016
[root@ip-172-31-29-157 log]# cat /etc/redhat-release
CentOS release 6.8 (Final)

And here's the content of my /var/log/ dir

[root@ip-172-31-29-157 log]# ls
total 4.6M
4.0K drwxr-xr-x.  9 root  root  4.0K Jun  1 14:31 .
4.0K drwxr-xr-x. 19 root  root  4.0K Mar 24  2014 ..
4.0K drwxr-x---.  2 root  root  4.0K May 11 02:17 audit
4.0K -rw-r--r--.  2 root  root  1.5K Jun  1 00:11 boot.log
   0 -rw-------.  1 root  utmp     0 Jun  1 03:44 btmp
   0 -rw-------.  1 root  utmp     0 May 26 21:12 btmp-20160601
4.0K drwxr-xr-x.  2 root  root  4.0K Jun  1 03:44 ConsoleKit
   0 -rw-------.  1 root  root     0 Jun  1 14:31 cron
1.8M -rw-------.  1 root  root  1.8M Jun  1 14:01 cron-20160601
 28K -rw-r--r--.  1 root  root   25K Jun  1 00:11 dmesg
 24K -rw-r--r--.  1 root  root   23K May 23 01:32 dmesg.old
   0 -rw-r--r--.  1 root  root     0 May 27 03:44 dracut.log
2.4M -rw-r--r--.  1 root  root  2.4M May 27 03:44 dracut.log-20160527
4.0K drwxr-x---.  2 exim  exim  4.0K Jun  1 14:31 exim
4.0K drwx------.  2 root  root  4.0K Jun  1 14:31 httpd
   0 -rw-r--r--.  1 root  root     0 Jun  1 14:31 kernel
4.0K -rw-r--r--.  1 root  root   250 Jun  1 14:25 kernel-20160601
4.0K -rw-r--r--.  1 root  root   64K Jun  1 14:18 lastlog
   0 -rw-------.  1 root  root     0 Jun  1 14:31 maillog
   0 -rw-------.  1 root  root     0 May 31 23:29 maillog-20160601
   0 -rw-r--r--.  1 root  root     0 Jun  1 14:31 messages
   0 -rw-r--r--.  1 root  root     0 Jun  1 14:23 messages-20160601
4.0K drwx------.  2 munge munge 4.0K Feb 20  2014 munge
4.0K drwxr-xr-x.  2 root  root  4.0K Jun  1 03:44 newrelic
4.0K drwxr-xr-x.  2 ntp   ntp   4.0K May 11 16:04 ntpstats
   0 -rw-------.  1 root  root     0 Jun  1 14:31 secure
 68K -rw-------.  1 root  root   61K Jun  1 14:18 secure-20160601
   0 -rw-------.  1 root  root     0 Jun  1 14:31 spooler
   0 -rw-------.  1 root  root     0 May 31 23:29 spooler-20160601
   0 -rw-------.  1 root  root     0 May 26 21:11 tallylog
   0 -rw-rw-r--.  1 root  utmp     0 Jun  1 14:31 wtmp
164K -rw-rw-r--.  1 root  utmp  160K Jun  1 14:18 wtmp-20160601
   0 -rw-------.  1 root  root     0 Jun  1 14:31 yum.log
 24K -rw-------.  1 root  root   18K May 26 21:13 yum.log-20160601
  • Was it logging anything before? If so, what changed? If not, have you checked /etc/rsyslog.d for any files in there overriding the behavior? – allquixotic Jun 1 '16 at 19:12
  • @allquixotic I don't recall it ever working before, and there's nothing in that directory. – Tam N. Jun 2 '16 at 20:21
0

Unless you have any specific requirement not to, I'd remove the old version & its config and install the current (version 8) with a fresh config file and try with a fresh install.

Presuming you use yum as your package manager & you installed Rsyslog from it, update your repo file at /etc/yum.repos.d/rsyslog.repo to add;

[rsyslog_v8]
name=Adiscon CentOS-$releasever - local packages for $basearch
baseurl=http://rpms.adiscon.com/v8-stable/epel-$releasever/$basearch
enabled=1
gpgcheck=1
gpgkey=http://rpms.adiscon.com/RPM-GPG-KEY-Adiscon
protect=1

If you have any old repo's listed in there set enabled=0 to disable them. If you don't have a .repo file then you can make one and add that section above.

Then remove the current old version of rsyslog & its config directly;

rpm -e rsyslog --no-deps
rm /etc/rsyslog.conf

Then install the fresh version (8) from yum;

yum install rsyslog

Check the config is correct (defaults may be fine) and check its started & running /etc/init.d/rsyslog status

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.