Question

11

/var/log/syslog empty

rated 0 times [ 11] [ 0] / answers: 1 / hits: 15963 / 3 Years ago, mon, may 3, 2021, 12:41:26

Apparently my logs stopped working around Apr 10, as the current /var/log/syslog is empty, and /var/log/syslog.1 has the following for its last entries:

Apr 10 20:25:01 li243-206 CRON[2883]: (root) CMD (command -v debian-sa1 > /dev/null && debian-sa1 1 1)

Apr 10 20:27:16 li243-206 kernel: Kernel logging (proc) stopped.

Apr 10 20:27:16 li243-206 rsyslogd: [origin software="rsyslogd" swVersion="5.8.6" x-pid="2320" x-info="http://www.rsyslog.com"] exiting on signal 15.

I tried writing to it with logger "hello world", but nothing show up. rsyslog is indeed running, if I check with ps.

So I found this similar question, which led me to discover that /dev/xconsole was missing. I created it, rebooted, but still no joy.

How can I get syslog to work?

Answers

Only authorized users can answer the question. Please sign in first, or register a free account.

errettas

Add To Favorites

Follow

Total Points: 160

Total Questions: 118

Total Answers: 91

Location: Laos

Member since Fri, Sep 11, 2020

4 Years ago

errettas questions

1 Ubuntu 22.04 Firefox Snap breaks KeePassXC integration and other NativeMessaging protocol 25 apps

Fri, Apr 21, 23, 08:09, 1 Year ago

1 How do I change size of app icons in Activity Overview?

Tue, Jan 10, 23, 22:58, 1 Year ago

1 Not able to access files on XUbuntu box from Ubuntu box

Sun, Aug 22, 21, 23:47, 3 Years ago

1 How to remove a specific part of the file name from a lot of files

Mon, Nov 28, 22, 06:42, 1 Year ago

1 The cleanest way to compile Ubuntu from scratch?

Tue, Aug 3, 21, 20:06, 3 Years ago

View All

answered 3 Years ago rofity · Accepted Answer

I got it to work by changing ownership from messagebus.adm to syslog.adm, and then restarting rsyslog.

Kind of disturbing that this broke silently. Given this experience I am not terribly confident that the other log files are owned properly. Here's what I have currently:

-rw-r--r-- 1 root       root         0 May  1 06:31 alternatives.log

drwxr-x--- 2 root       adm       4096 Jun  9 06:46 apache2

drwxr-xr-x 2 root       root      4096 Jun  1 06:48 apt

-rw-r----- 1 messagebus adm          0 Oct 22  2012 auth.log

-rw-r----- 1 root       adm          0 Oct 22  2012 boot

-rw-r--r-- 1 root       root         0 Oct 22  2012 boot.log

-rw-r--r-- 1 root       root         0 Oct 22  2012 bootstrap.log

-rw-rw---- 1 root       utmp      2688 Jun  6 10:31 btmp

drwxr-xr-x 2 root       root      4096 Oct 18  2012 ConsoleKit

drwxr-xr-x 2 root       root      4096 Oct 16  2012 dist-upgrade

-rw-r----- 1 root       adm      11669 Jun  6 13:16 dmesg

-rw-r--r-- 1 root       root     24494 Jun  6 11:30 dpkg.log

-rw-r----- 1 root       adm        117 Jun  9 06:46 fail2ban.log

-rw-r--r-- 1 root       root     24024 Apr 11 10:36 faillog

-rw-r--r-- 1 root       root      1202 Apr 10 19:13 fontconfig.log

drwxr-xr-x 2 root       root      4096 Oct 18  2012 fsck

drwxr-xr-x 3 root       root      4096 Oct 18  2012 installer

-rw-r----- 1 messagebus adm          0 Oct 22  2012 kern.log

drwxr-xr-x 2 syslog     root      4096 Oct 18  2012 landscape

-rw-rw-r-- 1 root       utmp    292292 Jun  9 10:38 lastlog

-rw-r----- 1 messagebus adm          0 Oct 22  2012 mail.err

-rw-r----- 1 messagebus adm          0 Oct 22  2012 mail.log

drwxr-s--- 2 mysql      adm       4096 Jun  9 06:46 mysql

-rw-r----- 1 mysql      adm          0 Apr 29 07:48 mysql.err

-rw-r----- 1 mysql      adm          0 Jun  9 06:46 mysql.log

drwxr-xr-x 2 root       root      4096 Oct 18  2012 news

drwxr-xr-x 2 ntp        ntp       4096 Aug 20  2012 ntpstats

drwxr-xr-x 2 nobody     nogroup   4096 Apr 10 23:00 passenger-analytics

-rw-r----- 1 syslog     adm       3538 Jun  9 11:10 syslog

drwxr-xr-x 2 root       root      4096 May 24  2012 sysstat

-rw-r--r-- 1 root       root    285653 Jun  6 13:15 udev

-rw-r----- 1 messagebus adm          0 Oct 22  2012 ufw.log

drwxr-xr-x 2 root       root      4096 Jun  8 06:29 upstart

-rw-rw-r-- 1 root       utmp     44928 Jun  9 10:38 wtmp

Does this look correct?

Edit: related discussion here.