0

Problem

Periodically I encounter the problem that /var/log/syslog is empty.

$ ls /var/log/syslog
-rw-r----- 1 root adm 0 Dez 31 06:29 /var/log/syslog

Environment and Installed packages

I am using Debian Jessie.

Aptitude shows that I have installed the package inetutils-syslogd, and the package rsyslog is not installed.

Analysis

I have tried to find the problem using following commands:

$ service syslog start
Job for syslog.socket failed. See 'systemctl status syslog.socket' and 'journalctl -xn' for details.
Failed to start syslog.service: Unit syslog.service failed to load: No such file or directory.

$ systemctl status syslog.socket
* syslog.socket - Syslog Socket
   Loaded: loaded (/lib/systemd/system/syslog.socket; static)
   Active: inactive (dead)
     Docs: man:systemd.special(7)
           http://www.freedesktop.org/wiki/Software/systemd/syslog
   Listen: /run/systemd/journal/syslog (Datagram)

Mär 07 12:18:02 viathinksoft.de systemd[1]: Socket service syslog.service not loaded, refusing.
Mär 07 12:18:02 viathinksoft.de systemd[1]: Failed to listen on Syslog Socket.

$ systemctl status syslog.service
* syslog.service
   Loaded: not-found (Reason: No such file or directory)
   Active: inactive (dead)

Temporary solution

I have found out that there is a service called rsyslog, which is breaking my normal syslog service. But rsyslog is not installed on my system, so I have no idea what is going on, and how I can permanently remove rsyslog.

$ systemctl status rsyslog.service
* rsyslog.service - LSB: enhanced syslogd
   Loaded: loaded (/etc/init.d/rsyslog)
   Active: active (exited) since Di 2016-02-09 02:42:03 CET; 3 weeks 6 days ago

$ aptitude remove rsyslog
Es werden keine Pakete installiert, aktualisiert oder entfernt.
0 Pakete aktualisiert, 0 zusätzlich installiert, 0 werden entfernt und 0 nicht aktualisiert.
0 B an Archiven müssen heruntergeladen werden. Nach dem Entpacken werden 0 B zusätzlich belegt sein.

As temporary solution, I am running these commands:

$ service rsyslog stop
$ dpkg-reconfigure inetutils-syslogd

Then it will work. For a few weeks...

What can I do to solve the problem permanently?

1
  • to find out the package name, find the rsyslog.service file (find /usr -name rsyslog.service probably) and then dpkg -S /path/to/file will tell you the correct package name. Also FYI you can do "export LANG=C" to get English errors from your commands to post here. – Peter Mar 7 '16 at 11:54
1

Periodically I encounter the problem that /var/log/syslog is empty.

Check the syslog config file in "/etc/syslog/syslog.conf", and specify the log destinations accordingly.

I have found out that there is a service called rsyslog, which is breaking my >normal syslog service. But rsyslog is not installed on my system, so I have no >idea what is going on, and how I can permanently remove rsyslog.

rsyslog is the default log server present in your system, and you can find its config file in "/etc/rsyslog.conf". Dont try to remove it simply disable the rsyslog daemon by executing "systemctl disable rsyslog", so that on the next boot it wont restart automatically.

1
  • you can remove rsyslog just fine, its just one of many syslog services. if you install other syslog services (f.e. syslog-ng) it will remove rsyslog anyway. – Dennis Nolte Jul 3 '18 at 7:47
0

The details of syslog.socket (https://cgit.freedesktop.org/systemd/systemd/plain/units/syslog.socket) offer some explanation of what is going on:

[Unit]
Description=Syslog Socket
Documentation=man:systemd.special(7)
Documentation=http://www.freedesktop.org/wiki/Software/systemd/syslog
DefaultDependencies=no
Before=sockets.target shutdown.target

# Don't allow logging until the very end
Conflicts=shutdown.target

[Socket]
ListenDatagram=/run/systemd/journal/syslog
SocketMode=0666
PassCredentials=yes
PassSecurity=yes
ReceiveBuffer=8M

# The default syslog implementation should make syslog.service a
# symlink to itself, so that this socket activates the right actual
# syslog service.
#
# Examples:
#
# /etc/systemd/system/syslog.service -> /lib/systemd/system/rsyslog.service
# /etc/systemd/system/syslog.service -> /lib/systemd/system/syslog-ng.service
#
# Best way to achieve that is by adding this to your unit file
# (i.e. to rsyslog.service or syslog-ng.service):
#
# [Install]
# Alias=syslog.service
#
# See http://www.freedesktop.org/wiki/Software/systemd/syslog for details.

Some discussion about it is available at https://www.freedesktop.org/wiki/Software/systemd/syslog/.

The syslog.socket unit is a generic unit that (in effect) simply ensures that a socket exists for journald to speak to a syslog daemon when it needs to.

In more practical terms, journald uses /run/systemd/journal/syslog to bridge to syslog (any syslog implementation), and syslog.socket links that path to whatever the OS's default syslog is.

In your case, the system uses rsyslog to provide the syslog implementation.

So you should have a syslog.service, which is actually a pointer to rsyslog.service. Or, in other words, you should probably consider leaving rsyslog enabled (sudo systemctl enable rsyslog.service), unless you have a specific reason for wanting to use another syslog implementation. If you do, then you just need to link that syslog's service file to syslog.service.

Or, you can create a drop-in for your preferred syslog, which contains:

[Install]
Alias=syslog.service

See https://coreos.com/os/docs/latest/using-systemd-drop-in-units.html (for example) for a bit more on drop-ins.

2
  • Hello, thank you for your answer. I am still suffering from that problem. IIRC, rsyslog had the problem that it used some database for the logs, and I wanted explictly a simple text file /var/log/syslog , and inetutils-syslogd does that. The file syslog.socket is located at /lib/systemd/system/syslog.socket and does not contain a reference to rsyslog.service . My system does NOT contain the files /run/systemd/journal/syslog (referenced in syslog.socket), and – Daniel Marschall Mar 12 '17 at 15:55
  • I don't have syslog.service or rsyslog.service (not found via locate). Therefore, systemctl enable rsyslog.service and systemctl enable rsyslog.service also fail with Failed to execute operation: No such file or directory. – Daniel Marschall Mar 12 '17 at 15:55
0

In my case with Ubuntu 16.04.3 LTS server I've solved with

sudo chown syslog:adm /var/log/syslog

rsyslog was up and running:

$ sudo systemctl status rsyslog.service                                                                                                                                                                                                                                               
* rsyslog.service - System Logging Service
   Loaded: loaded (/lib/systemd/system/rsyslog.service; enabled; vendor preset: enabled)
   Active: active (running) since Sat 2018-06-30 03:52:25 -03; 2 days ago
     Docs: man:rsyslogd(8)
           http://www.rsyslog.com/doc/
 Main PID: 90 (rsyslogd)

The cause seems to be on the ownership of the file, should be syslog instead of root. Couldn't found the bug report.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.