Friday, May 3, 2024
 Popular · Latest · Hot · Upcoming
3
rated 0 times [  3] [ 0]  / answers: 1 / hits: 40580  / 2 Years ago, sun, june 12, 2022, 1:52:36

It seems rsyslogd stopped writing to /var/log/syslog on my laptop two days ago, and I do't know why.



This is visible in the following:



clh@avignon:/var/log$ ls -lt | head -30
total 12600
drwxr-xr-x 2 root root 4096 Jan 30 09:53 upstart
-rw-r--r-- 1 root root 223836 Jan 30 09:37 dpkg.log
-rw-rw-r-- 1 root utmp 361728 Jan 30 09:20 wtmp
-rw-r--r-- 1 root root 31376 Jan 30 09:19 Xorg.0.log
-rw-r--r-- 1 root root 262055 Jan 30 09:19 pm-powersave.log
drwxr-xr-x 2 root root 4096 Jan 30 09:19 lightdm
-rw-r--r-- 1 root root 3177 Jan 30 09:18 boot.log
-rw-r----- 1 root adm 60332 Jan 30 09:18 dmesg
-rw-r--r-- 1 root root 334169 Jan 30 09:18 udev
-rw-r--r-- 1 root root 32014 Jan 30 09:16 Xorg.0.log.old
-rw-r----- 1 root adm 60381 Jan 30 09:07 dmesg.0
drwxr-xr-x 2 root root 4096 Jan 30 07:54 cups
-rw-r----- 1 messagebus adm 0 Jan 29 06:39 syslog
-rw-r----- 1 root adm 16101 Jan 29 06:30 dmesg.1.gz
-rw-r----- 1 messagebus adm 186869 Jan 28 20:57 kern.log
-rw-r----- 1 messagebus adm 147391 Jan 28 20:57 syslog.1
-rw-r--r-- 1 root root 4524 Jan 28 20:33 alternatives.log
-rw-rw-r-- 1 root utmp 8760000 Jan 28 20:32 lastlog
-rw-r--r-- 1 root root 960000 Jan 28 20:32 faillog
-rw-r----- 1 root adm 16029 Jan 28 14:25 dmesg.2.gz
-rw-r----- 1 messagebus adm 21598 Jan 28 07:31 syslog.2.gz
-rw-r----- 1 root adm 15926 Jan 28 06:59 dmesg.3.gz
-rw-r----- 1 messagebus adm 19983 Jan 27 07:55 syslog.3.gz


The last few lines of syslog.1 are:



Jan 28 20:55:30 avignon pulseaudio[7825]: [pulseaudio] pid.c: Daemon already running.
Jan 28 20:55:42 avignon goa[8118]: goa-daemon version 3.6.0 starting [main.c:112, main()]
Jan 28 20:55:46 avignon signond[8250]: signondaemon.cpp 345 init Failed to SUID root. Secure storage will not be available.
Jan 28 20:57:42 avignon gnome-session[7875]: CRITICAL: gsm_manager_set_phase: assertion `GSM_IS_MANAGER (manager)' failed
Jan 28 20:57:42 avignon gnome-session[7875]: Gtk-CRITICAL: gtk_main_quit: assertion `main_loops != NULL' failed
Jan 28 20:57:42 avignon kernel: Kernel logging (proc) stopped.
Jan 28 20:57:42 avignon rsyslogd: [origin software="rsyslogd" swVersion="5.8.6" x-pid="1090" x-info="http://www.rsyslog.com"] exiting on signal 15.


The last few lines of kern.log are:



Jan 28 20:10:44 avignon kernel: [20707.335160] psmouse serio2: Touchpad at isa0060/serio2/input0 lost sync at byte 6
Jan 28 20:10:44 avignon kernel: [20707.369217] psmouse serio2: Touchpad at isa0060/serio2/input0 - driver resynced.
Jan 28 20:57:42 avignon kernel: Kernel logging (proc) stopped.


The first few lines of /etc/rsyslog.d/50-default.conf are



#
auth,authpriv.* /var/log/auth.log
*.*;auth,authpriv.none -/var/log/syslog
#cron.* /var/log/cron.log
#daemon.* -/var/log/daemon.log
kern.* -/var/log/kern.log
#lpr.* -/var/log/lpr.log
mail.* -/var/log/mail.log
#user.* -/var/log/user.log


The date of the above configuration file is 30 March 2012.



The only two things I can think of is that some update somewhere has fragged my logging, or perhaps because I am trying out Gnome Shell (started at about the same time logging stopped) that I have "done something".



Any help greatly appreciated!


More From » 12.10

 Answers
0

From what I can see, your 50-default.conf file matches the default, so that's probably not the problem: http://bazaar.launchpad.net/~ubuntu-branches/ubuntu/quantal/rsyslog/quantal/view/head:/debian/50-default.conf



Happily, it looks like rsyslog has a config-checking mode that should help you troubleshoot what is actually going on. From their help page:




Rsyslog 3.21.1 and above has been enhanced to support extended
configuration checking. It offers a special command line switch (-N1)
that puts it into "config verfication mode". In that mode, it
interprets and check the configuration file, but does not startup.
This mode can be used in parallel to a running instance of rsyslogd.



To enable it, run rsyslog interactively as follows:



/path/to/rsyslogd -f/path/to/config-file -N1



You should also specify other options you usually give (like -c3 and
whatever else). Any problems experienced are reported to stderr [aka
"your screen" (if not redirected)].




http://www.rsyslog.com/doc/troubleshoot.html


[#32925] Sunday, June 12, 2022, 2 Years  [reply] [flag answer]
Only authorized users can answer the question. Please sign in first, or register a free account.
guialk

Total Points: 300
Total Questions: 144
Total Answers: 121

Location: Saint Vincent and the Grenadines
Member since Sat, Sep 11, 2021
3 Years ago
;