10

Apparently my logs stopped working around Apr 10, as the current /var/log/syslog is empty, and /var/log/syslog.1 has the following for its last entries:

Apr 10 20:25:01 li243-206 CRON[2883]: (root) CMD (command -v debian-sa1 > /dev/null && debian-sa1 1 1)
Apr 10 20:27:16 li243-206 kernel: Kernel logging (proc) stopped.
Apr 10 20:27:16 li243-206 rsyslogd: [origin software="rsyslogd" swVersion="5.8.6" x-pid="2320" x-info="http://www.rsyslog.com"] exiting on signal 15.

I tried writing to it with logger "hello world", but nothing show up. rsyslog is indeed running, if I check with ps.

So I found this similar question, which led me to discover that /dev/xconsole was missing. I created it, rebooted, but still no joy.

How can I get syslog to work?

3 Answers 3

11

I got it to work by changing ownership from messagebus.adm to syslog.adm, and then restarting rsyslog.

Kind of disturbing that this broke silently. Given this experience I am not terribly confident that the other log files are owned properly. Here's what I have currently:

-rw-r--r-- 1 root       root         0 May  1 06:31 alternatives.log
drwxr-x--- 2 root       adm       4096 Jun  9 06:46 apache2
drwxr-xr-x 2 root       root      4096 Jun  1 06:48 apt
-rw-r----- 1 messagebus adm          0 Oct 22  2012 auth.log
-rw-r----- 1 root       adm          0 Oct 22  2012 boot
-rw-r--r-- 1 root       root         0 Oct 22  2012 boot.log
-rw-r--r-- 1 root       root         0 Oct 22  2012 bootstrap.log
-rw-rw---- 1 root       utmp      2688 Jun  6 10:31 btmp
drwxr-xr-x 2 root       root      4096 Oct 18  2012 ConsoleKit
drwxr-xr-x 2 root       root      4096 Oct 16  2012 dist-upgrade
-rw-r----- 1 root       adm      11669 Jun  6 13:16 dmesg
-rw-r--r-- 1 root       root     24494 Jun  6 11:30 dpkg.log
-rw-r----- 1 root       adm        117 Jun  9 06:46 fail2ban.log
-rw-r--r-- 1 root       root     24024 Apr 11 10:36 faillog
-rw-r--r-- 1 root       root      1202 Apr 10 19:13 fontconfig.log
drwxr-xr-x 2 root       root      4096 Oct 18  2012 fsck
drwxr-xr-x 3 root       root      4096 Oct 18  2012 installer
-rw-r----- 1 messagebus adm          0 Oct 22  2012 kern.log
drwxr-xr-x 2 syslog     root      4096 Oct 18  2012 landscape
-rw-rw-r-- 1 root       utmp    292292 Jun  9 10:38 lastlog
-rw-r----- 1 messagebus adm          0 Oct 22  2012 mail.err
-rw-r----- 1 messagebus adm          0 Oct 22  2012 mail.log
drwxr-s--- 2 mysql      adm       4096 Jun  9 06:46 mysql
-rw-r----- 1 mysql      adm          0 Apr 29 07:48 mysql.err
-rw-r----- 1 mysql      adm          0 Jun  9 06:46 mysql.log
drwxr-xr-x 2 root       root      4096 Oct 18  2012 news
drwxr-xr-x 2 ntp        ntp       4096 Aug 20  2012 ntpstats
drwxr-xr-x 2 nobody     nogroup   4096 Apr 10 23:00 passenger-analytics
-rw-r----- 1 syslog     adm       3538 Jun  9 11:10 syslog
drwxr-xr-x 2 root       root      4096 May 24  2012 sysstat
-rw-r--r-- 1 root       root    285653 Jun  6 13:15 udev
-rw-r----- 1 messagebus adm          0 Oct 22  2012 ufw.log
drwxr-xr-x 2 root       root      4096 Jun  8 06:29 upstart
-rw-rw-r-- 1 root       utmp     44928 Jun  9 10:38 wtmp

Does this look correct?

Edit: related discussion here.

1

According to Caffeine Coma's answer, Please try this command:

sudo chown syslog:adm /var/log/syslog

Then restart services or restart your system(reboot).

1
  • restart of services was not needed on Ubuntu 12
    – tutejszy
    Apr 29, 2020 at 11:26
-2

same problem here /var/log/syslog empty (Ubuntu 14.04.5 LTS) What worked for me was changing the rights to 777 and testing thus :

chmod 777 syslog
logger "hello world"

and you can follow it working with :

tail -f /var/log/syslog 
1
  • 4
    You should never chmod 777 a file. The problem is most likely an ownership issue.
    – fpietka
    Dec 27, 2018 at 15:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .