Ok, but some more thoughts: - Regarding: apt-cache policy rsyslog; rsyslogd -version make sure you're on '8.2001.0-1ubuntu1.1' package level (and not on 8.2001.0-1ubuntu1) $ apt-cache policy rsyslog | grep Installed Installed: 8.2001.0-1ubuntu1.1 (from the logs I can only see 'v8.2001.0' which is reported in both cases - I believe)
- with that also make sure the latest logrotate package is installed: $ apt-cache policy logrotate | grep Installed Installed: 3.14.0-4ubuntu3 - Just to double check: did you ran 'systemctl status syslog' at a point where the syslog was no longer working? if not please provide the output of this in case syslog stopped working - Were user, group and/or other permissions changed, check/compare: $ ls -ld /var/log/ drwxrwxr-x 11 root syslog 4096 Sep 22 16:27 /var/log/ $ ls -la /var/log/syslog -rw-r----- 1 syslog adm 5598 Sep 29 07:05 /var/log/syslog - Was the rsyslog configuration changed? according to your previousmsg the config looks like the (unchanged) default config (anyway, a quick rsyslog config validation can be done with: rsyslogd -N1) - Do you have selinux installed and enabled ? (/usr/sbin/sestatus) - Did the time (or TZ) of the system changed in anyway? "rsyslog no longer stops receiving messages after system time change" https://bugzilla.redhat.com/show_bug.cgi?id=1088021 - Is someone/something sending signals to rsyslog (in addition to logrotate)? I see msgs like "rsyslogd was HUPed" -- it could just be caused by a normal logrotate, but if not: according to the rsyslogd mane page: "HUP This lets rsyslogd perform close all open files." - Could you run the following sequence: - systemctl status syslog.service - sudo logrotate --force --verbose /etc/logrotate.conf - logger -e "Test Error" - journalctl --no-pager | grep "Test" Sep 29 06:38:40 s1lp15 ubuntu[206083]: Test Error - systemctl status syslog.service - Potential systemd problems could be found with: grep -i systemd /var/log/syslog - I guess you already checked for syslog unit issues in the journal: journalctl -u syslog.service - If all this will not provide more indications about what might have happened, I guess rsyslog in debug mode could be a next step (https://www.rsyslog.com/doc/v8-stable/troubleshooting/debug.html) ** Bug watch added: Red Hat Bugzilla #1088021 https://bugzilla.redhat.com/show_bug.cgi?id=1088021 -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1896575 Title: [UBUNTU 20.04] syslog daemon stop running unexpectedly To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu-z-systems/+bug/1896575/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
