Hi All
I am having an issue with Rsyslog and it driving my up the wall.
I run a simple test program in my Debian server(Linux 3.16.0-4-amd64 #1 SMP
Debian 3.16.43-2+deb8u5) to test the rsyslog.service.
Here is my simple c program:
#include <syslog.h>
int main(int argc, char **argv)
{
openlog("testLog", LOG_CONS | LOG_PID, LOG_LOCAL2);
syslog(LOG_INFO,
"This is a syslog test message generated by program '%s'\n",
argv[0]);
closelog();
return 0;
}
And I have the following config, I add the local2 action at the end of the
config file ( I del all comments) :
#/etc/rsyslog.conf
module(load="imuxsock") # provides support for local system logging
module(load="imklog") # provides kernel logging support
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$FileOwner root
$FileGroup adm
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022
$WorkDirectory /var/spool/rsyslog
$IncludeConfig /etc/rsyslog.d/*.conf
auth,authpriv.* /var/log/auth.log
*.*;auth,authpriv.none -/var/log/syslog
daemon.* -/var/log/daemon.log
kern.* -/var/log/kern.log
lpr.* -/var/log/lpr.log
mail.* -/var/log/mail.log
user.* -/var/log/user.log
mail.info -/var/log/mail.info
mail.warn -/var/log/mail.warn
mail.err /var/log/mail.err
*.=debug;\
auth,authpriv.none;\
news.none;mail.none -/var/log/debug
*.=info;*.=notice;*.=warn;\
auth,authpriv.none;\
cron,daemon.none;\
mail,news.none -/var/log/messages
*.emerg :omusrmsg:*
local2.* -/var/log/test.log
when restart rsyslog.service and run the c program, nothing happened. there
is still no file named test.log in /var/log
I am sure the rsyslog.service is active (running).
Lsof shows that rsyslogd does not open /var/log/test.log
root@n15-063-146:~/test# lsof -p 93927
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
rsyslogd 93927 root cwd DIR 8,1 4096 2 /
rsyslogd 93927 root rtd DIR 8,1 4096 2 /
rsyslogd 93927 root txt REG 8,1 649400 1588484
/usr/sbin/rsyslogd
rsyslogd 93927 root mem REG 8,1 10128 1589673
/usr/lib/x86_64-linux-gnu/rsyslog/lmtcpclt.so
rsyslogd 93927 root mem REG 8,1 20560 1589671
/usr/lib/x86_64-linux-gnu/rsyslog/lmnetstrms.so
rsyslogd 93927 root mem REG 8,1 40464 1589670
/usr/lib/x86_64-linux-gnu/rsyslog/imfile.so
rsyslogd 93927 root mem REG 8,1 19512 1589663
/usr/lib/x86_64-linux-gnu/rsyslog/imklog.so
rsyslogd 93927 root mem REG 8,1 36864 1589668
/usr/lib/x86_64-linux-gnu/rsyslog/imuxsock.so
rsyslogd 93927 root mem REG 8,1 23056 1589659
/usr/lib/x86_64-linux-gnu/rsyslog/lmnet.so
rsyslogd 93927 root mem REG 8,1 1738176 786612
/lib/x86_64-linux-gnu/libc-2.19.so
rsyslogd 93927 root mem REG 8,1 18480 1577463
/usr/lib/x86_64-linux-gnu/liblogging-stdlog.so.0.0.0
rsyslogd 93927 root mem REG 8,1 18904 786735
/lib/x86_64-linux-gnu/libuuid.so.1.3.0
rsyslogd 93927 root mem REG 8,1 39272 1588480
/usr/lib/x86_64-linux-gnu/libfastjson.so.4.0.0
rsyslogd 93927 root mem REG 8,1 14248 1577453
/usr/lib/x86_64-linux-gnu/libestr.so.0.0.0
rsyslogd 93927 root mem REG 8,1 31784 786632
/lib/x86_64-linux-gnu/librt-2.19.so
rsyslogd 93927 root mem REG 8,1 14664 786618
/lib/x86_64-linux-gnu/libdl-2.19.so
rsyslogd 93927 root mem REG 8,1 137384 786633
/lib/x86_64-linux-gnu/libpthread-2.19.so
rsyslogd 93927 root mem REG 8,1 109144 786741
/lib/x86_64-linux-gnu/libz.so.1.2.8
rsyslogd 93927 root mem REG 8,1 140928 786613
/lib/x86_64-linux-gnu/ld-2.19.so
rsyslogd 93927 root 0r CHR 1,3 0t0 1028
/dev/null
rsyslogd 93927 root 1w CHR 1,3 0t0 1028
/dev/null
rsyslogd 93927 root 2w CHR 1,3 0t0 1028
/dev/null
rsyslogd 93927 root 3u unix 0xffff88104fb25800 0t0 44689
/run/systemd/journal/syslog
rsyslogd 93927 root 4r REG 0,3 0 4026532001
/proc/kmsg
rsyslogd 93927 root 5u unix 0xffff8810504347c0 0t0 872157792
socket
rsyslogd 93927 root 6r REG 8,1 53652804 1310748
/var/log/audit/audit.log
rsyslogd 93927 root 7u IPv4 939439781 0t0 UDP
*:16828
rsyslogd 93927 root 8u IPv4 939439784 0t0 UDP
*:12713
rsyslogd 93927 root 9w REG 8,1 72234671 1310751
/var/log/syslog
rsyslogd 93927 root 10w REG 8,1 77899784 1311967
/var/log/messages
And the default rules in config seems work fine, I have some system logs in
/var/log/syslog. And here's still enough space to write logs.
where did i go wrong?
thanks in advance.
--
Sent from: http://rsyslog-users.1305293.n2.nabble.com/
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
