Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I just noticed that the logging system is broken on my debian machine, syslog is empty and nothing is begin added into the syslog.

I need to fix this, but where do I start ?

What would cause this ?

syslog-ng config seems to be fine and syslog-ng process is running, disks are not full and folders are correct.

/var/log > ps -ef | grep syslog
root      1463     1  0 Aug01 ?        00:00:00 /sbin/mdadm --monitor --pid-file /var/run/mdadm/monitor.pid --daemonise --scan --syslog
root     15495 15482  0 18:06 pts/7    00:00:00 tail -f syslog
root     15729     1  0 18:17 ?        00:00:00 supervising syslog-ng                        
root     15730 15729  0 18:17 ?        00:00:00 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid


cat /etc/syslog-ng/syslog-ng.conf
@version: 3.1
#
# Syslog-ng configuration file, compatible with default Debian syslogd
# installation. Originally written by anonymous (I can't find his name)
# Revised, and rewrited by me (SZALAY Attila <sasa@debian.org>)

# First, set some global options.
options { long_hostnames(off); flush_lines(0); use_dns(no); use_fqdn(no);
      owner("root"); group("adm"); perm(0640); stats_freq(600);
      bad_hostname("^gconfd$");
};

########################
# Sources
########################
# This is the default behavior of sysklogd package
# Logs may come from unix stream, but not from another machine.
#
source s_src { unix-dgram("/dev/log"); internal();
             file("/proc/kmsg" program_override("kernel"));
};

# If you wish to get logs from remote machine you should uncomment
# this and comment the above source line.
#
#source s_net { tcp(ip(127.0.0.1) port(1000) authentication(required) encrypt(allow)); };

########################
# Destinations
########################
# First some standard logfile
#
destination d_auth { file("/var/log/auth.log"); };
destination d_cron { file("/var/log/cron.log"); };
destination d_daemon { file("/var/log/daemon.log"); };
destination d_kern { file("/var/log/kern.log"); };
destination d_lpr { file("/var/log/lpr.log"); };
destination d_mail { file("/var/log/mail.log"); };
destination d_syslog { file("/var/log/syslog"); };
destination d_user { file("/var/log/user.log"); };
destination d_uucp { file("/var/log/uucp.log"); };

# This files are the log come from the mail subsystem.
#
destination d_mailinfo { file("/var/log/mail/mail.info"); };
destination d_mailwarn { file("/var/log/mail/mail.warn"); };
destination d_mailerr { file("/var/log/mail/mail.err"); };
share|improve this question
    
Is your syslog service running? –  Shane Madden Sep 2 '11 at 16:15
    
yea it's running –  Lucas Kauffman Sep 2 '11 at 16:15
1  
syslog-ng service is running, disk is not full, rights on the dirs are normal (compared to another debian squeeze machine) –  Goez Sep 2 '11 at 16:18
1  
Please give us the output of ps -ef | grep syslog and cat /etc/syslog.conf? –  quanta Sep 2 '11 at 16:22
1  
We use syslog-ng btw, output will be placed in comment by Lucas. Config file for syslog-ng is /etc/syslog-ng/syslog-ng.conf –  Goez Sep 2 '11 at 16:26

1 Answer 1

up vote 1 down vote accepted

Its seems for some reason the config file lost its filters and destinations in the syslog-ng.conf file. Altering the file to a default dpkg package file worked.

Thx for all the suggestions.

share|improve this answer
    
thank you goez I wish we had you on our server team cough –  Lucas Kauffman Sep 2 '11 at 16:33

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.