Resolved Messages log is failing

[Pleskie]

Since February 20 my "messages" in /var/log log stopped logging.

It says:

... rsyslogd: [origin software="rsyslogd" swVersion="7.4.7" x-pid="159" x-info="http://www.rsyslog.com"] rsyslogd was HUPed

I'm on Centos 7.

Does anyone know what is causing this?

 

[UFHH01]

Hi Pleskie,

rsyslogd: [origin software="rsyslogd" swVersion="7.4.7" x-pid="159" x-info="http://www.rsyslog.com"] rsyslogd was HUPed

This message just indicates, that "rsyslogd" has been restarted, which is a absolut normal behaviour at log - rotation.

Since February 20 my "messages" in /var/log log stopped logging.

First, pls. let's check if "System Logging Service rsyslog" is currently active and running: service rsyslog status

Pls. post the output of your current systemd - configuration:

grep Syslog /etc/systemd/journald.conf

Change the configuration, if you desire forwarding to "rsyslog" log - files.​

Pls use the following command, to show actual messages, which are formerly stored inside "/var/log/messages", when forwarding to "syslog" has been configured on your server:

journalctl -f

Pls. consider as well to use the "--help" option string with commands, to display possible command options and descriptions!​

 

[Pleskie]

I restarted the service. It seems to be running ... but not logging anything :-s

service rsyslog status
Redirecting to /bin/systemctl status rsyslog.service
● rsyslog.service - System Logging Service
Loaded: loaded (/usr/lib/systemd/system/rsyslog.service; enabled; vendor preset: enabled)
Active: active (running) since ma 2017-03-13 00:13:34 CET; 5min ago
Main PID: 1933 (rsyslogd)
CGroup: /system.slice/rsyslog.service
└─1933 /usr/sbin/rsyslogd -n

grep Syslog /etc/systemd/journald.conf
#ForwardToSyslog=yes
#MaxLevelSyslog=debug

journalctl -f

I see some messages ... the most recent ones are from February 21 ... and there it stops. No recent messages.


Any idea on what I should do next?

 

[UFHH01]

grep Syslog /etc/systemd/journald.conf
#ForwardToSyslog=yes
#MaxLevelSyslog=debug

Did you notice the "#" in front of these settings? This means, that the setting will be ignored - no forwarding will be done.

 

[Pleskie]

OMG ... how could that have happened

I never ever have changed that! Do you have any idea what could have caused that?

 

[UFHH01]

Hi Pleskie,

during YUM - updates/upgrades, to keep your system up-to-date, you might have choosen for example the "-y" option, which answers all questions with a general "yes", for example. These questions are mostly configured "to keep existent configuration files" as they are, but in some cases, they could be replaced with new standarts, which may change YOUR configuration to the default ones, provided by the vendor of a package.

 

[Pleskie]

By the way ... what exactly do I need to do to get the old situation with the "messages" log and "secure" log in /var/log ?

 

[Pleskie]

Hi Pleskie,

during YUM - updates/upgrades, to keep your system up-to-date, you might have choosen for example the "-y" option, which answers all questions with a general "yes", for example. These questions are mostly configured "to keep existent configuration files" as they are, but in some cases, they could be replaced with new standarts, which may change YOUR configuration to the default ones, provided by the vendor of a package.

Aha! Well there is a lesson to be learned ... that could have maybe been the case. When i update through the Plesk Panel ... will it also use the -y option?

 

[UFHH01]

Hi Pleskie,

By the way ... what exactly do I need to do to get the old situation with the "messages" log and "secure" log in /var/log ?

The configuration for "rsyslogd" for example is done at "/etc/rsyslog.conf" and with additional configuration files, located at "/etc/rsyslog.d/" ( pls. read the corresponding manuals, examples...and pls. don't forget to use Google: => http://lmgtfy.com/?q="CentOS+7"+"rsyslog.conf"+"/etc/rsyslog.d/" ).

When i update through the Plesk Panel ... will it also use the -y option?

The STANDART "safe updates for system packages" - mode, should not use the "-y" - option, while it certainly may be, that updates from different repositories might replace their corresponding configuration files - depending to the vendor and it's standarts.

 

[Pleskie]

Thanks ...

But how do I enable the rsyslog?

If I uncomment ...

#ForwardToSyslog=yes

... will this enable rsyslog?

 

[UFHH01]

Hi Pleskie,

I know it's late in germany, but we will get nowhere, if you don't read and understand suggestions and descriptions.

Did you notice the "#" in front of these settings? This means, that the setting will be ignored - no forwarding will be done.

As stated, there is no FORWARDING at the moment, because you didn't set that in your configuration of "journald.conf". Afterwards, you should RESTART depending services, because you changed depending configurations. ( hint: systemctl restart systemd-journald.service / service rsyslog restart )

 

[Pleskie]

Well I uncommented and restarted ... but still nothing happens

The services seem to be running though.

 

[UFHH01]

Hi Pleskie,

are these configuration settings available in your "/etc/rsyslog.conf" ?

$ModLoad imuxsock
$OmitLocalLoggin off
$ModLoad imjournal

Is the following setting present in your "/etc/rsyslog.d/listen.conf" ?

$SystemLogSocketName /run/systemd/journal/syslog

 

[Pleskie]

Woooooow ... you are a HERO!

This one ...

$OmitLocalLoggin off

... was set to

$OmitLocalLoggin on

Would've never found that myself.

Everything seems to be working as before now.

Thanks very very much!!!