/var/log/syslog is empty. Service rsyslog is running, but not installed

Question

Problem

Periodically I encounter the problem that /var/log/syslog is empty.

$ ls /var/log/syslog
-rw-r----- 1 root adm 0 Dez 31 06:29 /var/log/syslog

Environment and Installed packages

I am using Debian Jessie.

Aptitude shows that I have installed the package inetutils-syslogd, and the package rsyslog is not installed.

Analysis

I have tried to find the problem using following commands:

$ service syslog start
Job for syslog.socket failed. See 'systemctl status syslog.socket' and 'journalctl -xn' for details.
Failed to start syslog.service: Unit syslog.service failed to load: No such file or directory.

$ systemctl status syslog.socket
* syslog.socket - Syslog Socket
   Loaded: loaded (/lib/systemd/system/syslog.socket; static)
   Active: inactive (dead)
     Docs: man:systemd.special(7)
           http://www.freedesktop.org/wiki/Software/systemd/syslog
   Listen: /run/systemd/journal/syslog (Datagram)

Mär 07 12:18:02 viathinksoft.de systemd[1]: Socket service syslog.service not loaded, refusing.
Mär 07 12:18:02 viathinksoft.de systemd[1]: Failed to listen on Syslog Socket.

$ systemctl status syslog.service
* syslog.service
   Loaded: not-found (Reason: No such file or directory)
   Active: inactive (dead)

Temporary solution

I have found out that there is a service called rsyslog, which is breaking my normal syslog service. But rsyslog is not installed on my system, so I have no idea what is going on, and how I can permanently remove rsyslog.

$ systemctl status rsyslog.service
* rsyslog.service - LSB: enhanced syslogd
   Loaded: loaded (/etc/init.d/rsyslog)
   Active: active (exited) since Di 2016-02-09 02:42:03 CET; 3 weeks 6 days ago

$ aptitude remove rsyslog
Es werden keine Pakete installiert, aktualisiert oder entfernt.
0 Pakete aktualisiert, 0 zusätzlich installiert, 0 werden entfernt und 0 nicht aktualisiert.
0 B an Archiven müssen heruntergeladen werden. Nach dem Entpacken werden 0 B zusätzlich belegt sein.

As temporary solution, I am running these commands:

$ service rsyslog stop
$ dpkg-reconfigure inetutils-syslogd

Then it will work. For a few weeks...

What can I do to solve the problem permanently?

Answer 1

Periodically I encounter the problem that /var/log/syslog is empty.

Check the syslog config file in "/etc/syslog/syslog.conf", and specify the log destinations accordingly.

I have found out that there is a service called rsyslog, which is breaking my >normal syslog service. But rsyslog is not installed on my system, so I have no >idea what is going on, and how I can permanently remove rsyslog.

rsyslog is the default log server present in your system, and you can find its config file in "/etc/rsyslog.conf". Dont try to remove it simply disable the rsyslog daemon by executing "systemctl disable rsyslog", so that on the next boot it wont restart automatically.

Answer 2

The details of syslog.socket (https://cgit.freedesktop.org/systemd/systemd/plain/units/syslog.socket) offer some explanation of what is going on:

[Unit]
Description=Syslog Socket
Documentation=man:systemd.special(7)
Documentation=http://www.freedesktop.org/wiki/Software/systemd/syslog
DefaultDependencies=no
Before=sockets.target shutdown.target

# Don't allow logging until the very end
Conflicts=shutdown.target

[Socket]
ListenDatagram=/run/systemd/journal/syslog
SocketMode=0666
PassCredentials=yes
PassSecurity=yes
ReceiveBuffer=8M

# The default syslog implementation should make syslog.service a
# symlink to itself, so that this socket activates the right actual
# syslog service.
#
# Examples:
#
# /etc/systemd/system/syslog.service -> /lib/systemd/system/rsyslog.service
# /etc/systemd/system/syslog.service -> /lib/systemd/system/syslog-ng.service
#
# Best way to achieve that is by adding this to your unit file
# (i.e. to rsyslog.service or syslog-ng.service):
#
# [Install]
# Alias=syslog.service
#
# See http://www.freedesktop.org/wiki/Software/systemd/syslog for details.

Some discussion about it is available at https://www.freedesktop.org/wiki/Software/systemd/syslog/.

The syslog.socket unit is a generic unit that (in effect) simply ensures that a socket exists for journald to speak to a syslog daemon when it needs to.

In more practical terms, journald uses /run/systemd/journal/syslog to bridge to syslog (any syslog implementation), and syslog.socket links that path to whatever the OS's default syslog is.

In your case, the system uses rsyslog to provide the syslog implementation.

So you should have a syslog.service, which is actually a pointer to rsyslog.service. Or, in other words, you should probably consider leaving rsyslog enabled (sudo systemctl enable rsyslog.service), unless you have a specific reason for wanting to use another syslog implementation. If you do, then you just need to link that syslog's service file to syslog.service.

Or, you can create a drop-in for your preferred syslog, which contains:

[Install]
Alias=syslog.service

See https://coreos.com/os/docs/latest/using-systemd-drop-in-units.html (for example) for a bit more on drop-ins.

Answer 3

In my case with Ubuntu 16.04.3 LTS server I've solved with

sudo chown syslog:adm /var/log/syslog

rsyslog was up and running:

$ sudo systemctl status rsyslog.service                                                                                                                                                                                                                                               
* rsyslog.service - System Logging Service
   Loaded: loaded (/lib/systemd/system/rsyslog.service; enabled; vendor preset: enabled)
   Active: active (running) since Sat 2018-06-30 03:52:25 -03; 2 days ago
     Docs: man:rsyslogd(8)
           http://www.rsyslog.com/doc/
 Main PID: 90 (rsyslogd)

The cause seems to be on the ownership of the file, should be syslog instead of root. Couldn't found the bug report.