------- Comment From [email protected] 2020-09-30 15:01 EDT------- (In reply to comment #18) > Ok, but some more thoughts: > > - Regarding: apt-cache policy rsyslog; rsyslogd -version > make sure you're on '8.2001.0-1ubuntu1.1' package level (and not on > 8.2001.0-1ubuntu1) > $ apt-cache policy rsyslog | grep Installed > Installed: 8.2001.0-1ubuntu1.1 > (from the logs I can only see 'v8.2001.0' which is reported in both cases - > I believe) > > - with that also make sure the latest logrotate package is installed: > $ apt-cache policy logrotate | grep Installed > Installed: 3.14.0-4ubuntu3 > > - Just to double check: did you ran 'systemctl status syslog' at a point > where the syslog was no longer working? > if not please provide the output of this in case syslog stopped working > > - Were user, group and/or other permissions changed, check/compare: > $ ls -ld /var/log/ > drwxrwxr-x 11 root syslog 4096 Sep 22 16:27 /var/log/ > $ ls -la /var/log/syslog > -rw-r----- 1 syslog adm 5598 Sep 29 07:05 /var/log/syslog > > - Was the rsyslog configuration changed? > according to your previousmsg the config looks like the (unchanged) default > config > (anyway, a quick rsyslog config validation can be done with: rsyslogd -N1) > > - Do you have selinux installed and enabled ? (/usr/sbin/sestatus) > > - Did the time (or TZ) of the system changed in anyway? > "rsyslog no longer stops receiving messages after system time change" > https://bugzilla.redhat.com/show_bug.cgi?id=1088021 > > - Is someone/something sending signals to rsyslog (in addition to logrotate)? > I see msgs like "rsyslogd was HUPed" -- it could just be caused by a normal > logrotate, but if not: according to the rsyslogd mane page: "HUP This > lets rsyslogd perform close all open files." > > - Could you run the following sequence: > - systemctl status syslog.service > - sudo logrotate --force --verbose /etc/logrotate.conf > - logger -e "Test Error" > - journalctl --no-pager | grep "Test" > Sep 29 06:38:40 s1lp15 ubuntu[206083]: Test Error > - systemctl status syslog.service > > - Potential systemd problems could be found with: grep -i systemd > /var/log/syslog > > - I guess you already checked for syslog unit issues in the journal: > journalctl -u syslog.service > > - If all this will not provide more indications about what might have > happened, I guess rsyslog in debug mode could be a next step > (https://www.rsyslog.com/doc/v8-stable/troubleshooting/debug.html)
-rsyslogd version installed: root@ilzlnx4:~# apt-cache policy rsyslog | grep Installed Installed: 8.2001.0-1ubuntu1.1 -logrotate package: root@ilzlnx4:~# apt-cache policy logrotate | grep Installed Installed: 3.14.0-4ubuntu3 - syslog status report when it is not working: root@ilzlnx4:~# systemctl status syslog ?? rsyslog.service - System Logging Service Loaded: loaded (/lib/systemd/system/rsyslog.service; enabled; vendor preset: enabled) Active: active (running) since Sat 2020-09-26 06:50:29 MST; 4 days ago TriggeredBy: ?? syslog.socket Docs: man:rsyslogd(8) https://www.rsyslog.com/doc/ Main PID: 1678161 (rsyslogd) Tasks: 4 (limit: 38379) Memory: 28.6M CGroup: /system.slice/rsyslog.service ????1678161 /usr/sbin/rsyslogd -n -iNONE Sep 26 06:50:29 ilzlnx4 systemd[1]: Starting System Logging Service... Sep 26 06:50:29 ilzlnx4 rsyslogd[1678161]: imuxsock: Acquired UNIX socket '/run/systemd/journal/syslog' (fd 3) from systemd. [v8.2001.0] Sep 26 06:50:29 ilzlnx4 systemd[1]: Started System Logging Service. Sep 26 06:50:29 ilzlnx4 rsyslogd[1678161]: rsyslogd's groupid changed to 110 Sep 26 06:50:29 ilzlnx4 rsyslogd[1678161]: rsyslogd's userid changed to 104 Sep 26 06:50:29 ilzlnx4 rsyslogd[1678161]: [origin software="rsyslogd" swVersion="8.2001.0" x-pid="1678161" x-info="https://www.rsyslog.com";] start Sep 27 00:00:18 ilzlnx4 rsyslogd[1678161]: [origin software="rsyslogd" swVersion="8.2001.0" x-pid="1678161" x-info="https://www.rsyslog.com";] rsyslogd was - syslog directories permisions: root@ilzlnx4:~# ls -ld /var/log drwxrwxr-x 13 root syslog 4096 Sep 27 00:00 /var/log root@ilzlnx4:~# ls -la /var/log/syslog -rw-r----- 1 syslog adm 0 Sep 27 00:00 /var/log/syslog - rsyslog configuration: root@ilzlnx4:~# rsyslogd -N1 rsyslogd: version 8.2001.0, config validation run (level 1), master config /etc/rsyslog.conf rsyslogd: End of config validation run. Bye. - selinux not installed: root@ilzlnx4:~# ll /usr/sbin/sestatus ls: cannot access '/usr/sbin/sestatus': No such file or directory - No time changes done in the system - Only logger command is being used to to write messages to the log - Output of sequence execution requested root@ilzlnx4:~# systemctl status syslog.service ?? rsyslog.service - System Logging Service Loaded: loaded (/lib/systemd/system/rsyslog.service; enabled; vendor preset: enabled) Active: active (running) since Sat 2020-09-26 06:50:29 MST; 4 days ago TriggeredBy: ?? syslog.socket Docs: man:rsyslogd(8) https://www.rsyslog.com/doc/ Main PID: 1678161 (rsyslogd) Tasks: 4 (limit: 38379) Memory: 28.7M CGroup: /system.slice/rsyslog.service ????1678161 /usr/sbin/rsyslogd -n -iNONE Sep 26 06:50:29 ilzlnx4 systemd[1]: Starting System Logging Service... Sep 26 06:50:29 ilzlnx4 rsyslogd[1678161]: imuxsock: Acquired UNIX socket '/run/systemd/journal/syslog' (fd 3) from systemd. [v8.2001.0] Sep 26 06:50:29 ilzlnx4 systemd[1]: Started System Logging Service. Sep 26 06:50:29 ilzlnx4 rsyslogd[1678161]: rsyslogd's groupid changed to 110 Sep 26 06:50:29 ilzlnx4 rsyslogd[1678161]: rsyslogd's userid changed to 104 Sep 26 06:50:29 ilzlnx4 rsyslogd[1678161]: [origin software="rsyslogd" swVersion="8.2001.0" x-pid="1678161" x-info="https://www.rsyslog.com";] start Sep 27 00:00:18 ilzlnx4 rsyslogd[1678161]: [origin software="rsyslogd" swVersion="8.2001.0" x-pid="1678161" x-info="https://www.rsyslog.com";] rsyslogd was HUPed root@ilzlnx4:~# sudo logrotate --force --verbose /etc/logrotate.conf reading config file /etc/logrotate.conf including /etc/logrotate.d reading config file alternatives reading config file apport reading config file apt reading config file bootlog reading config file btmp reading config file cups-daemon reading config file dpkg reading config file firewalld reading config file lightdm reading config file ppp reading config file rsyslog reading config file slim reading config file speech-dispatcher reading config file ubuntu-advantage-tools reading config file ufw reading config file unattended-upgrades reading config file wtmp Reading state from file: /var/lib/logrotate/status Allocating hash table for state file, size 64 entries Creating new state Creating new state Creating new state Creating new state Creating new state Creating new state Creating new state Creating new state Creating new state Creating new state Creating new state Creating new state Creating new state Creating new state Creating new state Creating new state Creating new state Creating new state Creating new state Creating new state Creating new state Creating new state Creating new state Creating new state Creating new state Creating new state Creating new state Creating new state Creating new state Creating new state Creating new state Creating new state Creating new state Creating new state Creating new state Creating new state Handling 20 logs rotating pattern: /var/log/alternatives.log forced from command line (12 rotations) empty log files are not rotated, old logs are removed switching euid to 0 and egid to 4 considering log /var/log/alternatives.log Now: 2020-09-30 11:06 Last rotated at 2020-09-01 00:00 log needs rotating rotating log /var/log/alternatives.log, log->rotateCount is 12 dateext suffix '-20200930' glob pattern '-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]' compressing log with: /bin/gzip switching uid to 0 and gid to 4 renaming /var/log/alternatives.log.12.gz to /var/log/alternatives.log.13.gz (rotatecount 12, logstart 1, i 12), old log /var/log/alternatives.log.12.gz does not exist renaming /var/log/alternatives.log.11.gz to /var/log/alternatives.log.12.gz (rotatecount 12, logstart 1, i 11), old log /var/log/alternatives.log.11.gz does not exist renaming /var/log/alternatives.log.10.gz to /var/log/alternatives.log.11.gz (rotatecount 12, logstart 1, i 10), old log /var/log/alternatives.log.10.gz does not exist renaming /var/log/alternatives.log.9.gz to /var/log/alternatives.log.10.gz (rotatecount 12, logstart 1, i 9), old log /var/log/alternatives.log.9.gz does not exist renaming /var/log/alternatives.log.8.gz to /var/log/alternatives.log.9.gz (rotatecount 12, logstart 1, i 8), old log /var/log/alternatives.log.8.gz does not exist renaming /var/log/alternatives.log.7.gz to /var/log/alternatives.log.8.gz (rotatecount 12, logstart 1, i 7), old log /var/log/alternatives.log.7.gz does not exist renaming /var/log/alternatives.log.6.gz to /var/log/alternatives.log.7.gz (rotatecount 12, logstart 1, i 6), old log /var/log/alternatives.log.6.gz does not exist renaming /var/log/alternatives.log.5.gz to /var/log/alternatives.log.6.gz (rotatecount 12, logstart 1, i 5), old log /var/log/alternatives.log.5.gz does not exist renaming /var/log/alternatives.log.4.gz to /var/log/alternatives.log.5.gz (rotatecount 12, logstart 1, i 4), old log /var/log/alternatives.log.4.gz does not exist renaming /var/log/alternatives.log.3.gz to /var/log/alternatives.log.4.gz (rotatecount 12, logstart 1, i 3), old log /var/log/alternatives.log.3.gz does not exist renaming /var/log/alternatives.log.2.gz to /var/log/alternatives.log.3.gz (rotatecount 12, logstart 1, i 2), renaming /var/log/alternatives.log.1.gz to /var/log/alternatives.log.2.gz (rotatecount 12, logstart 1, i 1), renaming /var/log/alternatives.log.0.gz to /var/log/alternatives.log.1.gz (rotatecount 12, logstart 1, i 0), old log /var/log/alternatives.log.0.gz does not exist log /var/log/alternatives.log.13.gz doesn't exist -- won't try to dispose of it renaming /var/log/alternatives.log to /var/log/alternatives.log.1 creating new /var/log/alternatives.log mode = 0644 uid = 0 gid = 0 switching euid to 0 and egid to 0 rotating pattern: /var/log/apport.log forced from command line (7 rotations) empty log files are not rotated, old logs are removed switching euid to 0 and egid to 4 considering log /var/log/apport.log Now: 2020-09-30 11:06 Last rotated at 2020-08-04 00:00 log does not need rotating (log is empty) switching euid to 0 and egid to 0 rotating pattern: /var/log/apt/term.log forced from command line (12 rotations) empty log files are not rotated, old logs are removed switching euid to 0 and egid to 4 considering log /var/log/apt/term.log Now: 2020-09-30 11:06 Last rotated at 2020-09-01 00:00 log needs rotating rotating log /var/log/apt/term.log, log->rotateCount is 12 dateext suffix '-20200930' glob pattern '-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]' renaming /var/log/apt/term.log.12.gz to /var/log/apt/term.log.13.gz (rotatecount 12, logstart 1, i 12), old log /var/log/apt/term.log.12.gz does not exist renaming /var/log/apt/term.log.11.gz to /var/log/apt/term.log.12.gz (rotatecount 12, logstart 1, i 11), old log /var/log/apt/term.log.11.gz does not exist renaming /var/log/apt/term.log.10.gz to /var/log/apt/term.log.11.gz (rotatecount 12, logstart 1, i 10), old log /var/log/apt/term.log.10.gz does not exist renaming /var/log/apt/term.log.9.gz to /var/log/apt/term.log.10.gz (rotatecount 12, logstart 1, i 9), old log /var/log/apt/term.log.9.gz does not exist renaming /var/log/apt/term.log.8.gz to /var/log/apt/term.log.9.gz (rotatecount 12, logstart 1, i 8), old log /var/log/apt/term.log.8.gz does not exist renaming /var/log/apt/term.log.7.gz to /var/log/apt/term.log.8.gz (rotatecount 12, logstart 1, i 7), old log /var/log/apt/term.log.7.gz does not exist renaming /var/log/apt/term.log.6.gz to /var/log/apt/term.log.7.gz (rotatecount 12, logstart 1, i 6), old log /var/log/apt/term.log.6.gz does not exist renaming /var/log/apt/term.log.5.gz to /var/log/apt/term.log.6.gz (rotatecount 12, logstart 1, i 5), old log /var/log/apt/term.log.5.gz does not exist renaming /var/log/apt/term.log.4.gz to /var/log/apt/term.log.5.gz (rotatecount 12, logstart 1, i 4), old log /var/log/apt/term.log.4.gz does not exist renaming /var/log/apt/term.log.3.gz to /var/log/apt/term.log.4.gz (rotatecount 12, logstart 1, i 3), renaming /var/log/apt/term.log.2.gz to /var/log/apt/term.log.3.gz (rotatecount 12, logstart 1, i 2), renaming /var/log/apt/term.log.1.gz to /var/log/apt/term.log.2.gz (rotatecount 12, logstart 1, i 1), renaming /var/log/apt/term.log.0.gz to /var/log/apt/term.log.1.gz (rotatecount 12, logstart 1, i 0), old log /var/log/apt/term.log.0.gz does not exist log /var/log/apt/term.log.13.gz doesn't exist -- won't try to dispose of it renaming /var/log/apt/term.log to /var/log/apt/term.log.1 creating new /var/log/apt/term.log mode = 0640 uid = 0 gid = 4 compressing log with: /bin/gzip switching uid to 0 and gid to 4 switching euid to 0 and egid to 0 rotating pattern: /var/log/apt/history.log forced from command line (12 rotations) empty log files are not rotated, old logs are removed switching euid to 0 and egid to 4 considering log /var/log/apt/history.log Now: 2020-09-30 11:06 Last rotated at 2020-09-01 00:00 log needs rotating rotating log /var/log/apt/history.log, log->rotateCount is 12 dateext suffix '-20200930' glob pattern '-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]' renaming /var/log/apt/history.log.12.gz to /var/log/apt/history.log.13.gz (rotatecount 12, logstart 1, i 12), old log /var/log/apt/history.log.12.gz does not exist renaming /var/log/apt/history.log.11.gz to /var/log/apt/history.log.12.gz (rotatecount 12, logstart 1, i 11), old log /var/log/apt/history.log.11.gz does not exist renaming /var/log/apt/history.log.10.gz to /var/log/apt/history.log.11.gz (rotatecount 12, logstart 1, i 10), old log /var/log/apt/history.log.10.gz does not exist renaming /var/log/apt/history.log.9.gz to /var/log/apt/history.log.10.gz (rotatecount 12, logstart 1, i 9), old log /var/log/apt/history.log.9.gz does not exist renaming /var/log/apt/history.log.8.gz to /var/log/apt/history.log.9.gz (rotatecount 12, logstart 1, i 8), old log /var/log/apt/history.log.8.gz does not exist renaming /var/log/apt/history.log.7.gz to /var/log/apt/history.log.8.gz (rotatecount 12, logstart 1, i 7), old log /var/log/apt/history.log.7.gz does not exist renaming /var/log/apt/history.log.6.gz to /var/log/apt/history.log.7.gz (rotatecount 12, logstart 1, i 6), old log /var/log/apt/history.log.6.gz does not exist renaming /var/log/apt/history.log.5.gz to /var/log/apt/history.log.6.gz (rotatecount 12, logstart 1, i 5), old log /var/log/apt/history.log.5.gz does not exist renaming /var/log/apt/history.log.4.gz to /var/log/apt/history.log.5.gz (rotatecount 12, logstart 1, i 4), old log /var/log/apt/history.log.4.gz does not exist renaming /var/log/apt/history.log.3.gz to /var/log/apt/history.log.4.gz (rotatecount 12, logstart 1, i 3), renaming /var/log/apt/history.log.2.gz to /var/log/apt/history.log.3.gz (rotatecount 12, logstart 1, i 2), renaming /var/log/apt/history.log.1.gz to /var/log/apt/history.log.2.gz (rotatecount 12, logstart 1, i 1), renaming /var/log/apt/history.log.0.gz to /var/log/apt/history.log.1.gz (rotatecount 12, logstart 1, i 0), old log /var/log/apt/history.log.0.gz does not exist log /var/log/apt/history.log.13.gz doesn't exist -- won't try to dispose of it renaming /var/log/apt/history.log to /var/log/apt/history.log.1 creating new /var/log/apt/history.log mode = 0644 uid = 0 gid = 0 compressing log with: /bin/gzip switching uid to 0 and gid to 4 switching euid to 0 and egid to 0 rotating pattern: /var/log/boot.log forced from command line (7 rotations) empty log files are not rotated, old logs are removed switching euid to 0 and egid to 4 considering log /var/log/boot.log log /var/log/boot.log does not exist -- skipping switching euid to 0 and egid to 0 rotating pattern: /var/log/btmp forced from command line (1 rotations) empty log files are rotated, old logs are removed switching euid to 0 and egid to 4 considering log /var/log/btmp Now: 2020-09-30 11:06 Last rotated at 2020-09-01 00:00 log needs rotating rotating log /var/log/btmp, log->rotateCount is 1 dateext suffix '-20200930' glob pattern '-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]' renaming /var/log/btmp.1 to /var/log/btmp.2 (rotatecount 1, logstart 1, i 1), renaming /var/log/btmp.0 to /var/log/btmp.1 (rotatecount 1, logstart 1, i 0), old log /var/log/btmp.0 does not exist renaming /var/log/btmp to /var/log/btmp.1 creating new /var/log/btmp mode = 0660 uid = 0 gid = 43 removing old log /var/log/btmp.2 switching euid to 0 and egid to 0 rotating pattern: /var/log/cups/*log forced from command line (7 rotations) empty log files are not rotated, old logs are removed switching euid to 0 and egid to 4 considering log /var/log/cups/access_log Now: 2020-09-30 11:06 Last rotated at 2020-09-30 00:00 log needs rotating rotating log /var/log/cups/access_log, log->rotateCount is 7 dateext suffix '-20200930' glob pattern '-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]' compressing log with: /bin/gzip switching uid to 0 and gid to 4 renaming /var/log/cups/access_log.7.gz to /var/log/cups/access_log.8.gz (rotatecount 7, logstart 1, i 7), renaming /var/log/cups/access_log.6.gz to /var/log/cups/access_log.7.gz (rotatecount 7, logstart 1, i 6), renaming /var/log/cups/access_log.5.gz to /var/log/cups/access_log.6.gz (rotatecount 7, logstart 1, i 5), renaming /var/log/cups/access_log.4.gz to /var/log/cups/access_log.5.gz (rotatecount 7, logstart 1, i 4), renaming /var/log/cups/access_log.3.gz to /var/log/cups/access_log.4.gz (rotatecount 7, logstart 1, i 3), renaming /var/log/cups/access_log.2.gz to /var/log/cups/access_log.3.gz (rotatecount 7, logstart 1, i 2), renaming /var/log/cups/access_log.1.gz to /var/log/cups/access_log.2.gz (rotatecount 7, logstart 1, i 1), renaming /var/log/cups/access_log.0.gz to /var/log/cups/access_log.1.gz (rotatecount 7, logstart 1, i 0), old log /var/log/cups/access_log.0.gz does not exist renaming /var/log/cups/access_log to /var/log/cups/access_log.1 creating new /var/log/cups/access_log mode = 0640 uid = 0 gid = 4 running postrotate script switching euid to 0 and egid to 0 removing old log /var/log/cups/access_log.8.gz switching euid to 0 and egid to 0 rotating pattern: /var/log/dpkg.log forced from command line (12 rotations) empty log files are not rotated, old logs are removed switching euid to 0 and egid to 4 considering log /var/log/dpkg.log Now: 2020-09-30 11:06 Last rotated at 2020-09-01 00:00 log needs rotating rotating log /var/log/dpkg.log, log->rotateCount is 12 dateext suffix '-20200930' glob pattern '-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]' compressing log with: /bin/gzip switching uid to 0 and gid to 4 renaming /var/log/dpkg.log.12.gz to /var/log/dpkg.log.13.gz (rotatecount 12, logstart 1, i 12), old log /var/log/dpkg.log.12.gz does not exist renaming /var/log/dpkg.log.11.gz to /var/log/dpkg.log.12.gz (rotatecount 12, logstart 1, i 11), old log /var/log/dpkg.log.11.gz does not exist renaming /var/log/dpkg.log.10.gz to /var/log/dpkg.log.11.gz (rotatecount 12, logstart 1, i 10), old log /var/log/dpkg.log.10.gz does not exist renaming /var/log/dpkg.log.9.gz to /var/log/dpkg.log.10.gz (rotatecount 12, logstart 1, i 9), old log /var/log/dpkg.log.9.gz does not exist renaming /var/log/dpkg.log.8.gz to /var/log/dpkg.log.9.gz (rotatecount 12, logstart 1, i 8), old log /var/log/dpkg.log.8.gz does not exist renaming /var/log/dpkg.log.7.gz to /var/log/dpkg.log.8.gz (rotatecount 12, logstart 1, i 7), old log /var/log/dpkg.log.7.gz does not exist renaming /var/log/dpkg.log.6.gz to /var/log/dpkg.log.7.gz (rotatecount 12, logstart 1, i 6), old log /var/log/dpkg.log.6.gz does not exist renaming /var/log/dpkg.log.5.gz to /var/log/dpkg.log.6.gz (rotatecount 12, logstart 1, i 5), old log /var/log/dpkg.log.5.gz does not exist renaming /var/log/dpkg.log.4.gz to /var/log/dpkg.log.5.gz (rotatecount 12, logstart 1, i 4), old log /var/log/dpkg.log.4.gz does not exist renaming /var/log/dpkg.log.3.gz to /var/log/dpkg.log.4.gz (rotatecount 12, logstart 1, i 3), renaming /var/log/dpkg.log.2.gz to /var/log/dpkg.log.3.gz (rotatecount 12, logstart 1, i 2), renaming /var/log/dpkg.log.1.gz to /var/log/dpkg.log.2.gz (rotatecount 12, logstart 1, i 1), renaming /var/log/dpkg.log.0.gz to /var/log/dpkg.log.1.gz (rotatecount 12, logstart 1, i 0), old log /var/log/dpkg.log.0.gz does not exist log /var/log/dpkg.log.13.gz doesn't exist -- won't try to dispose of it renaming /var/log/dpkg.log to /var/log/dpkg.log.1 creating new /var/log/dpkg.log mode = 0644 uid = 0 gid = 0 switching euid to 0 and egid to 0 rotating pattern: /var/log/firewalld forced from command line (4 rotations) empty log files are rotated, only log files >= 1048576 bytes are rotated, old logs are removed switching euid to 0 and egid to 4 considering log /var/log/firewalld Now: 2020-09-30 11:06 Last rotated at 2020-08-04 00:00 log needs rotating rotating log /var/log/firewalld, log->rotateCount is 4 dateext suffix '-20200930' glob pattern '-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]' renaming /var/log/firewalld.4 to /var/log/firewalld.5 (rotatecount 4, logstart 1, i 4), old log /var/log/firewalld.4 does not exist renaming /var/log/firewalld.3 to /var/log/firewalld.4 (rotatecount 4, logstart 1, i 3), old log /var/log/firewalld.3 does not exist renaming /var/log/firewalld.2 to /var/log/firewalld.3 (rotatecount 4, logstart 1, i 2), old log /var/log/firewalld.2 does not exist renaming /var/log/firewalld.1 to /var/log/firewalld.2 (rotatecount 4, logstart 1, i 1), old log /var/log/firewalld.1 does not exist renaming /var/log/firewalld.0 to /var/log/firewalld.1 (rotatecount 4, logstart 1, i 0), old log /var/log/firewalld.0 does not exist log /var/log/firewalld.5 doesn't exist -- won't try to dispose of it copying /var/log/firewalld to /var/log/firewalld.1 truncating /var/log/firewalld switching euid to 0 and egid to 0 rotating pattern: /var/log/lightdm/*.log forced from command line (7 rotations) empty log files are not rotated, log files >= 10485760 are rotated earlier, old logs are removed switching euid to 0 and egid to 4 considering log /var/log/lightdm/*.log log /var/log/lightdm/*.log does not exist -- skipping switching euid to 0 and egid to 0 rotating pattern: /var/log/ppp-connect-errors forced from command line (4 rotations) empty log files are not rotated, old logs are removed switching euid to 0 and egid to 4 considering log /var/log/ppp-connect-errors log /var/log/ppp-connect-errors does not exist -- skipping switching euid to 0 and egid to 0 rotating pattern: /var/log/syslog forced from command line (7 rotations) empty log files are not rotated, old logs are removed switching euid to 0 and egid to 4 considering log /var/log/syslog Now: 2020-09-30 11:06 Last rotated at 2020-09-27 00:00 log does not need rotating (log is empty) switching euid to 0 and egid to 0 rotating pattern: /var/log/mail.info /var/log/mail.warn /var/log/mail.err /var/log/mail.log /var/log/daemon.log /var/log/kern.log /var/log/auth.log /var/log/user.log /var/log/lpr.log /var/log/cron.log /var/log/debug /var/log/messages forced from command line (4 rotations) empty log files are not rotated, old logs are removed switching euid to 0 and egid to 4 considering log /var/log/mail.info log /var/log/mail.info does not exist -- skipping considering log /var/log/mail.warn log /var/log/mail.warn does not exist -- skipping considering log /var/log/mail.err log /var/log/mail.err does not exist -- skipping considering log /var/log/mail.log log /var/log/mail.log does not exist -- skipping considering log /var/log/daemon.log log /var/log/daemon.log does not exist -- skipping considering log /var/log/kern.log Now: 2020-09-30 11:06 Last rotated at 2020-09-27 00:00 log does not need rotating (log is empty) considering log /var/log/auth.log Now: 2020-09-30 11:06 Last rotated at 2020-09-27 00:00 log does not need rotating (log is empty) considering log /var/log/user.log log /var/log/user.log does not exist -- skipping considering log /var/log/lpr.log log /var/log/lpr.log does not exist -- skipping considering log /var/log/cron.log log /var/log/cron.log does not exist -- skipping considering log /var/log/debug log /var/log/debug does not exist -- skipping considering log /var/log/messages log /var/log/messages does not exist -- skipping not running postrotate script, since no logs were rotated switching euid to 0 and egid to 0 rotating pattern: /var/log/slim.log forced from command line (4 rotations) empty log files are not rotated, old logs are removed switching euid to 0 and egid to 4 considering log /var/log/slim.log Now: 2020-09-30 11:06 Last rotated at 2020-09-23 00:00 log does not need rotating (log is empty) switching euid to 0 and egid to 0 rotating pattern: /var/log/speech-dispatcher/speech-dispatcher.log /var/log/speech-dispatcher/speech-dispatcher-protocol.log forced from command line (7 rotations) empty log files are rotated, old logs are removed switching euid to 0 and egid to 4 considering log /var/log/speech-dispatcher/speech-dispatcher.log log /var/log/speech-dispatcher/speech-dispatcher.log does not exist -- skipping considering log /var/log/speech-dispatcher/speech-dispatcher-protocol.log log /var/log/speech-dispatcher/speech-dispatcher-protocol.log does not exist -- skipping not running postrotate script, since no logs were rotated switching euid to 0 and egid to 0 rotating pattern: /var/log/speech-dispatcher/debug-epos-generic /var/log/speech-dispatcher/debug-festival /var/log/speech-dispatcher/debug-flite forced from command line (2 rotations) empty log files are rotated, old logs are removed switching euid to 0 and egid to 4 considering log /var/log/speech-dispatcher/debug-epos-generic log /var/log/speech-dispatcher/debug-epos-generic does not exist -- skipping considering log /var/log/speech-dispatcher/debug-festival log /var/log/speech-dispatcher/debug-festival does not exist -- skipping considering log /var/log/speech-dispatcher/debug-flite log /var/log/speech-dispatcher/debug-flite does not exist -- skipping not running postrotate script, since no logs were rotated switching euid to 0 and egid to 0 rotating pattern: /var/log/ubuntu-advantage.log forced from command line (6 rotations) empty log files are not rotated, old logs are removed switching euid to 0 and egid to 4 considering log /var/log/ubuntu-advantage.log Now: 2020-09-30 11:06 Last rotated at 2020-09-01 00:00 log needs rotating rotating log /var/log/ubuntu-advantage.log, log->rotateCount is 6 dateext suffix '-20200930' glob pattern '-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]' compressing log with: /bin/gzip switching uid to 0 and gid to 4 renaming /var/log/ubuntu-advantage.log.6.gz to /var/log/ubuntu-advantage.log.7.gz (rotatecount 6, logstart 1, i 6), old log /var/log/ubuntu-advantage.log.6.gz does not exist renaming /var/log/ubuntu-advantage.log.5.gz to /var/log/ubuntu-advantage.log.6.gz (rotatecount 6, logstart 1, i 5), old log /var/log/ubuntu-advantage.log.5.gz does not exist renaming /var/log/ubuntu-advantage.log.4.gz to /var/log/ubuntu-advantage.log.5.gz (rotatecount 6, logstart 1, i 4), old log /var/log/ubuntu-advantage.log.4.gz does not exist renaming /var/log/ubuntu-advantage.log.3.gz to /var/log/ubuntu-advantage.log.4.gz (rotatecount 6, logstart 1, i 3), renaming /var/log/ubuntu-advantage.log.2.gz to /var/log/ubuntu-advantage.log.3.gz (rotatecount 6, logstart 1, i 2), renaming /var/log/ubuntu-advantage.log.1.gz to /var/log/ubuntu-advantage.log.2.gz (rotatecount 6, logstart 1, i 1), renaming /var/log/ubuntu-advantage.log.0.gz to /var/log/ubuntu-advantage.log.1.gz (rotatecount 6, logstart 1, i 0), old log /var/log/ubuntu-advantage.log.0.gz does not exist log /var/log/ubuntu-advantage.log.7.gz doesn't exist -- won't try to dispose of it renaming /var/log/ubuntu-advantage.log to /var/log/ubuntu-advantage.log.1 creating new /var/log/ubuntu-advantage.log mode = 0600 uid = 0 gid = 0 switching euid to 0 and egid to 0 rotating pattern: /var/log/ufw.log forced from command line (4 rotations) empty log files are not rotated, old logs are removed switching euid to 0 and egid to 4 considering log /var/log/ufw.log Now: 2020-09-30 11:06 Last rotated at 2020-09-27 00:00 log does not need rotating (log is empty) not running postrotate script, since no logs were rotated switching euid to 0 and egid to 0 rotating pattern: /var/log/unattended-upgrades/unattended-upgrades.log /var/log/unattended-upgrades/unattended-upgrades-dpkg.log /var/log/unattended-upgrades/unattended-upgrades-shutdown.log forced from command line (6 rotations) empty log files are not rotated, old logs are removed switching euid to 0 and egid to 4 considering log /var/log/unattended-upgrades/unattended-upgrades.log Now: 2020-09-30 11:06 Last rotated at 2020-09-01 00:00 log needs rotating considering log /var/log/unattended-upgrades/unattended-upgrades-dpkg.log Now: 2020-09-30 11:06 Last rotated at 2020-09-01 00:00 log needs rotating considering log /var/log/unattended-upgrades/unattended-upgrades-shutdown.log Now: 2020-09-30 11:06 Last rotated at 2020-09-01 00:00 log needs rotating rotating log /var/log/unattended-upgrades/unattended-upgrades.log, log->rotateCount is 6 dateext suffix '-20200930' glob pattern '-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]' renaming /var/log/unattended-upgrades/unattended-upgrades.log.6.gz to /var/log/unattended-upgrades/unattended-upgrades.log.7.gz (rotatecount 6, logstart 1, i 6), old log /var/log/unattended-upgrades/unattended-upgrades.log.6.gz does not exist renaming /var/log/unattended-upgrades/unattended-upgrades.log.5.gz to /var/log/unattended-upgrades/unattended-upgrades.log.6.gz (rotatecount 6, logstart 1, i 5), old log /var/log/unattended-upgrades/unattended-upgrades.log.5.gz does not exist renaming /var/log/unattended-upgrades/unattended-upgrades.log.4.gz to /var/log/unattended-upgrades/unattended-upgrades.log.5.gz (rotatecount 6, logstart 1, i 4), old log /var/log/unattended-upgrades/unattended-upgrades.log.4.gz does not exist renaming /var/log/unattended-upgrades/unattended-upgrades.log.3.gz to /var/log/unattended-upgrades/unattended-upgrades.log.4.gz (rotatecount 6, logstart 1, i 3), renaming /var/log/unattended-upgrades/unattended-upgrades.log.2.gz to /var/log/unattended-upgrades/unattended-upgrades.log.3.gz (rotatecount 6, logstart 1, i 2), renaming /var/log/unattended-upgrades/unattended-upgrades.log.1.gz to /var/log/unattended-upgrades/unattended-upgrades.log.2.gz (rotatecount 6, logstart 1, i 1), renaming /var/log/unattended-upgrades/unattended-upgrades.log.0.gz to /var/log/unattended-upgrades/unattended-upgrades.log.1.gz (rotatecount 6, logstart 1, i 0), old log /var/log/unattended-upgrades/unattended-upgrades.log.0.gz does not exist log /var/log/unattended-upgrades/unattended-upgrades.log.7.gz doesn't exist -- won't try to dispose of it renaming /var/log/unattended-upgrades/unattended-upgrades.log to /var/log/unattended-upgrades/unattended-upgrades.log.1 creating new /var/log/unattended-upgrades/unattended-upgrades.log mode = 0644 uid = 0 gid = 0 compressing log with: /bin/gzip switching uid to 0 and gid to 4 rotating log /var/log/unattended-upgrades/unattended-upgrades-dpkg.log, log->rotateCount is 6 dateext suffix '-20200930' glob pattern '-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]' renaming /var/log/unattended-upgrades/unattended-upgrades-dpkg.log.6.gz to /var/log/unattended-upgrades/unattended-upgrades-dpkg.log.7.gz (rotatecount 6, logstart 1, i 6), old log /var/log/unattended-upgrades/unattended-upgrades-dpkg.log.6.gz does not exist renaming /var/log/unattended-upgrades/unattended-upgrades-dpkg.log.5.gz to /var/log/unattended-upgrades/unattended-upgrades-dpkg.log.6.gz (rotatecount 6, logstart 1, i 5), old log /var/log/unattended-upgrades/unattended-upgrades-dpkg.log.5.gz does not exist renaming /var/log/unattended-upgrades/unattended-upgrades-dpkg.log.4.gz to /var/log/unattended-upgrades/unattended-upgrades-dpkg.log.5.gz (rotatecount 6, logstart 1, i 4), old log /var/log/unattended-upgrades/unattended-upgrades-dpkg.log.4.gz does not exist renaming /var/log/unattended-upgrades/unattended-upgrades-dpkg.log.3.gz to /var/log/unattended-upgrades/unattended-upgrades-dpkg.log.4.gz (rotatecount 6, logstart 1, i 3), renaming /var/log/unattended-upgrades/unattended-upgrades-dpkg.log.2.gz to /var/log/unattended-upgrades/unattended-upgrades-dpkg.log.3.gz (rotatecount 6, logstart 1, i 2), renaming /var/log/unattended-upgrades/unattended-upgrades-dpkg.log.1.gz to /var/log/unattended-upgrades/unattended-upgrades-dpkg.log.2.gz (rotatecount 6, logstart 1, i 1), renaming /var/log/unattended-upgrades/unattended-upgrades-dpkg.log.0.gz to /var/log/unattended-upgrades/unattended-upgrades-dpkg.log.1.gz (rotatecount 6, logstart 1, i 0), old log /var/log/unattended-upgrades/unattended-upgrades-dpkg.log.0.gz does not exist log /var/log/unattended-upgrades/unattended-upgrades-dpkg.log.7.gz doesn't exist -- won't try to dispose of it renaming /var/log/unattended-upgrades/unattended-upgrades-dpkg.log to /var/log/unattended-upgrades/unattended-upgrades-dpkg.log.1 creating new /var/log/unattended-upgrades/unattended-upgrades-dpkg.log mode = 0644 uid = 0 gid = 4 compressing log with: /bin/gzip switching uid to 0 and gid to 4 rotating log /var/log/unattended-upgrades/unattended-upgrades-shutdown.log, log->rotateCount is 6 dateext suffix '-20200930' glob pattern '-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]' renaming /var/log/unattended-upgrades/unattended-upgrades-shutdown.log.6.gz to /var/log/unattended-upgrades/unattended-upgrades-shutdown.log.7.gz (rotatecount 6, logstart 1, i 6), old log /var/log/unattended-upgrades/unattended-upgrades-shutdown.log.6.gz does not exist renaming /var/log/unattended-upgrades/unattended-upgrades-shutdown.log.5.gz to /var/log/unattended-upgrades/unattended-upgrades-shutdown.log.6.gz (rotatecount 6, logstart 1, i 5), old log /var/log/unattended-upgrades/unattended-upgrades-shutdown.log.5.gz does not exist renaming /var/log/unattended-upgrades/unattended-upgrades-shutdown.log.4.gz to /var/log/unattended-upgrades/unattended-upgrades-shutdown.log.5.gz (rotatecount 6, logstart 1, i 4), old log /var/log/unattended-upgrades/unattended-upgrades-shutdown.log.4.gz does not exist renaming /var/log/unattended-upgrades/unattended-upgrades-shutdown.log.3.gz to /var/log/unattended-upgrades/unattended-upgrades-shutdown.log.4.gz (rotatecount 6, logstart 1, i 3), old log /var/log/unattended-upgrades/unattended-upgrades-shutdown.log.3.gz does not exist renaming /var/log/unattended-upgrades/unattended-upgrades-shutdown.log.2.gz to /var/log/unattended-upgrades/unattended-upgrades-shutdown.log.3.gz (rotatecount 6, logstart 1, i 2), renaming /var/log/unattended-upgrades/unattended-upgrades-shutdown.log.1.gz to /var/log/unattended-upgrades/unattended-upgrades-shutdown.log.2.gz (rotatecount 6, logstart 1, i 1), renaming /var/log/unattended-upgrades/unattended-upgrades-shutdown.log.0.gz to /var/log/unattended-upgrades/unattended-upgrades-shutdown.log.1.gz (rotatecount 6, logstart 1, i 0), old log /var/log/unattended-upgrades/unattended-upgrades-shutdown.log.0.gz does not exist log /var/log/unattended-upgrades/unattended-upgrades-shutdown.log.7.gz doesn't exist -- won't try to dispose of it renaming /var/log/unattended-upgrades/unattended-upgrades-shutdown.log to /var/log/unattended-upgrades/unattended-upgrades-shutdown.log.1 creating new /var/log/unattended-upgrades/unattended-upgrades-shutdown.log mode = 0644 uid = 0 gid = 0 compressing log with: /bin/gzip switching uid to 0 and gid to 4 switching euid to 0 and egid to 0 rotating pattern: /var/log/wtmp forced from command line (1 rotations) empty log files are rotated, only log files >= 1048576 bytes are rotated, old logs are removed switching euid to 0 and egid to 4 considering log /var/log/wtmp Now: 2020-09-30 11:06 Last rotated at 2020-08-17 00:00 log needs rotating rotating log /var/log/wtmp, log->rotateCount is 1 dateext suffix '-20200930' glob pattern '-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]' renaming /var/log/wtmp.1 to /var/log/wtmp.2 (rotatecount 1, logstart 1, i 1), renaming /var/log/wtmp.0 to /var/log/wtmp.1 (rotatecount 1, logstart 1, i 0), old log /var/log/wtmp.0 does not exist renaming /var/log/wtmp to /var/log/wtmp.1 creating new /var/log/wtmp mode = 0664 uid = 0 gid = 43 removing old log /var/log/wtmp.2 switching euid to 0 and egid to 0 root@ilzlnx4:~# logger -e "Test Error" root@ilzlnx4:~# journalctl --no-pager | grep "Test" root@ilzlnx4:~# tail /var/log/syslog root@ilzlnx4:~# Sep 30 11:07:19 ilzlnx4 root[1313063]: Test Error root@ilzlnx4:~# systemctl status syslog.service ?? rsyslog.service - System Logging Service Loaded: loaded (/lib/systemd/system/rsyslog.service; enabled; vendor preset: enabled) Active: active (running) since Sat 2020-09-26 06:50:29 MST; 4 days ago TriggeredBy: ?? syslog.socket Docs: man:rsyslogd(8) https://www.rsyslog.com/doc/ Main PID: 1678161 (rsyslogd) Tasks: 4 (limit: 38379) Memory: 28.7M CGroup: /system.slice/rsyslog.service ????1678161 /usr/sbin/rsyslogd -n -iNONE Sep 26 06:50:29 ilzlnx4 systemd[1]: Starting System Logging Service... Sep 26 06:50:29 ilzlnx4 rsyslogd[1678161]: imuxsock: Acquired UNIX socket '/run/systemd/journal/syslog' (fd 3) from systemd. [v8.2001.0] Sep 26 06:50:29 ilzlnx4 systemd[1]: Started System Logging Service. Sep 26 06:50:29 ilzlnx4 rsyslogd[1678161]: rsyslogd's groupid changed to 110 Sep 26 06:50:29 ilzlnx4 rsyslogd[1678161]: rsyslogd's userid changed to 104 Sep 26 06:50:29 ilzlnx4 rsyslogd[1678161]: [origin software="rsyslogd" swVersion="8.2001.0" x-pid="1678161" x-info="https://www.rsyslog.com";] start Sep 27 00:00:18 ilzlnx4 rsyslogd[1678161]: [origin software="rsyslogd" swVersion="8.2001.0" x-pid="1678161" x-info="https://www.rsyslog.com";] rsyslogd was HUPed - Note that after the journal command also the syslog file was check and it still empty - No messages related with systemd: root@ilzlnx4:~# grep -i systemd /var/log/syslog root@ilzlnx4:~# - journal output: root@ilzlnx4:~# journalctl -u syslog.service -- Logs begin at Tue 2020-09-22 10:27:27 MST, end at Wed 2020-09-30 11:16:31 MST. -- -- No entries -- - Enable the syslog debugger with the env variables and restarted the service root@ilzlnx4:~# printenv | grep RSYSLOG RSYSLOG_DEBUGLOG=/var/log/syslog.debug RSYSLOG_DEBUG=LogFuncFlow PrintFuncDB PrintMutexAction Debug OutputTidToStderr root@ilzlnx4:~# logger "Test Error" root@ilzlnx4:~# tail /var/log/syslog root@ilzlnx4:~# root@ilzlnx4:~# service syslog restart root@ilzlnx4:~# logger "Test Error" root@ilzlnx4:~# tail /var/log/syslog Sep 30 11:43:53 ilzlnx4 rsyslogd: [origin software="rsyslogd" swVersion="8.2001.0" x-pid="1678161" x-info="https://www.rsyslog.com";] exiting on signal 15. Sep 30 11:43:55 ilzlnx4 systemd[1]: rsyslog.service: Succeeded. Sep 30 11:43:55 ilzlnx4 systemd[1]: Stopped System Logging Service. Sep 30 11:43:55 ilzlnx4 systemd[1]: Starting System Logging Service... Sep 30 11:43:55 ilzlnx4 rsyslogd: imuxsock: Acquired UNIX socket '/run/systemd/journal/syslog' (fd 3) from systemd. [v8.2001.0] Sep 30 11:43:55 ilzlnx4 systemd[1]: Started System Logging Service. Sep 30 11:43:55 ilzlnx4 rsyslogd: rsyslogd's groupid changed to 110 Sep 30 11:43:55 ilzlnx4 rsyslogd: rsyslogd's userid changed to 104 Sep 30 11:43:55 ilzlnx4 rsyslogd: [origin software="rsyslogd" swVersion="8.2001.0" x-pid="1392149" x-info="https://www.rsyslog.com";] start Sep 30 11:44:06 ilzlnx4 root: Test Error - Also enable the debugger adding the lines in the rsyslog.conf and now it is information getting log $DebugFile /var/log/rsyslog.debug $DebugLevel 2 root@ilzlnx4:~# tail /var/log/rsyslog.debug 2491.118063597:main Q:Reg/w0 : ../action.c: actionCommit[action-8-builtin:omfwd]: done, iRet 0 2491.118065155:main Q:Reg/w0 : ruleset.c: processBATCH: batch of 1 elements has been processed 2491.118067355:main Q:Reg/w0 : queue.c: regular consumer finished, iret=0, szlog 0 sz phys 1 2491.118070664:main Q:Reg/w0 : queue.c: DeleteProcessedBatch: etry 0 state 3 2491.118072272:main Q:Reg/w0 : queue.c: DeleteProcessedBatch: we deleted 1 objects and enqueued 0 objects 2491.118073712:main Q:Reg/w0 : queue.c: rger: deleteBatchFromQStore, nElem 1 2491.118076234:main Q:Reg/w0 : queue.c: doDeleteBatch: delete batch from store, new sizes: log 0, phys 0 2491.118077888:main Q:Reg/w0 : main Q: queue.c: dequeued 0 consumable elements, szlog 0 sz phys 0 2491.118079592:main Q:Reg/w0 : queue.c: regular consumer finished, iret=4, szlog 0 sz phys 0 2491.118081196:main Q:Reg/w0 : wti.c: main Q:Reg/w0: worker IDLE, waiting for work. ------- Comment From [email protected] 2020-10-01 12:21 EDT------- After reboot and activate the syslog debug mode, the syslog crashed again. root@ilzlnx4:~# tail /var/log/syslog root@ilzlnx4:~# tail /var/log/syslog root@ilzlnx4:~# logger "Test Error" root@ilzlnx4:~# tail /var/log/syslog root@ilzlnx4:~# tail /var/log/syslog Attaching the debug log file generated: rsyslog.debug -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1896575 Title: [UBUNTU 20.04] syslog daemon stop running unexpectedly To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu-z-systems/+bug/1896575/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
