It seems rsyslogd stopped writing to /var/log/syslog on my laptop two days ago, and I do't know why.

This is visible in the following:

clh@avignon:/var/log$ ls -lt | head -30
total 12600
drwxr-xr-x 2 root              root    4096 Jan 30 09:53 upstart
-rw-r--r-- 1 root              root  223836 Jan 30 09:37 dpkg.log
-rw-rw-r-- 1 root              utmp  361728 Jan 30 09:20 wtmp
-rw-r--r-- 1 root              root   31376 Jan 30 09:19 Xorg.0.log
-rw-r--r-- 1 root              root  262055 Jan 30 09:19 pm-powersave.log
drwxr-xr-x 2 root              root    4096 Jan 30 09:19 lightdm
-rw-r--r-- 1 root              root    3177 Jan 30 09:18 boot.log
-rw-r----- 1 root              adm    60332 Jan 30 09:18 dmesg
-rw-r--r-- 1 root              root  334169 Jan 30 09:18 udev
-rw-r--r-- 1 root              root   32014 Jan 30 09:16 Xorg.0.log.old
-rw-r----- 1 root              adm    60381 Jan 30 09:07 dmesg.0
drwxr-xr-x 2 root              root    4096 Jan 30 07:54 cups
-rw-r----- 1 messagebus        adm        0 Jan 29 06:39 syslog
-rw-r----- 1 root              adm    16101 Jan 29 06:30 dmesg.1.gz
-rw-r----- 1 messagebus        adm   186869 Jan 28 20:57 kern.log
-rw-r----- 1 messagebus        adm   147391 Jan 28 20:57 syslog.1
-rw-r--r-- 1 root              root    4524 Jan 28 20:33 alternatives.log
-rw-rw-r-- 1 root              utmp 8760000 Jan 28 20:32 lastlog
-rw-r--r-- 1 root              root  960000 Jan 28 20:32 faillog
-rw-r----- 1 root              adm    16029 Jan 28 14:25 dmesg.2.gz
-rw-r----- 1 messagebus        adm    21598 Jan 28 07:31 syslog.2.gz
-rw-r----- 1 root              adm    15926 Jan 28 06:59 dmesg.3.gz
-rw-r----- 1 messagebus        adm    19983 Jan 27 07:55 syslog.3.gz

The last few lines of syslog.1 are:

Jan 28 20:55:30 avignon pulseaudio[7825]: [pulseaudio] pid.c: Daemon already running.
Jan 28 20:55:42 avignon goa[8118]: goa-daemon version 3.6.0 starting [main.c:112, main()]
Jan 28 20:55:46 avignon signond[8250]: signondaemon.cpp 345 init Failed to SUID root. Secure storage will not be available. 
Jan 28 20:57:42 avignon gnome-session[7875]: CRITICAL: gsm_manager_set_phase: assertion `GSM_IS_MANAGER (manager)' failed
Jan 28 20:57:42 avignon gnome-session[7875]: Gtk-CRITICAL: gtk_main_quit: assertion `main_loops != NULL' failed
Jan 28 20:57:42 avignon kernel: Kernel logging (proc) stopped.
Jan 28 20:57:42 avignon rsyslogd: [origin software="rsyslogd" swVersion="5.8.6" x-pid="1090" x-info="http://www.rsyslog.com"] exiting on signal 15.

The last few lines of kern.log are:

Jan 28 20:10:44 avignon kernel: [20707.335160] psmouse serio2: Touchpad at isa0060/serio2/input0 lost sync at byte 6
Jan 28 20:10:44 avignon kernel: [20707.369217] psmouse serio2: Touchpad at isa0060/serio2/input0 - driver resynced.
Jan 28 20:57:42 avignon kernel: Kernel logging (proc) stopped.

The first few lines of /etc/rsyslog.d/50-default.conf are

auth,authpriv.*                 /var/log/auth.log
*.*;auth,authpriv.none          -/var/log/syslog
#cron.*                         /var/log/cron.log
#daemon.*                       -/var/log/daemon.log
kern.*                          -/var/log/kern.log
#lpr.*                          -/var/log/lpr.log
mail.*                          -/var/log/mail.log
#user.*                         -/var/log/user.log

The date of the above configuration file is 30 March 2012.

The only two things I can think of is that some update somewhere has fragged my logging, or perhaps because I am trying out Gnome Shell (started at about the same time logging stopped) that I have "done something".

Any help greatly appreciated!

  • have you rebooted since then? – ImaginaryRobots Jan 30 '13 at 18:31
  • ImaginaryRobots, thanks for the suggestion. I have rebooted several times and to no obvious effect. Two things I should mention: 1) doesn't seem to matter if I'm in Unity or Gnome Shell 2) "ps" tells me that rsyslogd is running with parameter -c5 – Monet's Chemist Jan 31 '13 at 1:14
  • Here my case with Ubuntu 16.04 and how I solved it. – Pablo Bianchi Jul 3 '18 at 4:43

From what I can see, your 50-default.conf file matches the default, so that's probably not the problem: http://bazaar.launchpad.net/~ubuntu-branches/ubuntu/quantal/rsyslog/quantal/view/head:/debian/50-default.conf

Happily, it looks like rsyslog has a config-checking mode that should help you troubleshoot what is actually going on. From their help page:

Rsyslog 3.21.1 and above has been enhanced to support extended configuration checking. It offers a special command line switch (-N1) that puts it into "config verfication mode". In that mode, it interprets and check the configuration file, but does not startup. This mode can be used in parallel to a running instance of rsyslogd.

To enable it, run rsyslog interactively as follows:

/path/to/rsyslogd -f/path/to/config-file -N1

You should also specify other options you usually give (like -c3 and whatever else). Any problems experienced are reported to stderr [aka "your screen" (if not redirected)].


| improve this answer | |
  • 3
    ImaginaryRobots, you are leading me down a very interesting path here, thanks very much for your help. Using it, I have identified the problem, but I am now uncertain as to what to do to solve it. the message I get is rsyslogd: Could not open output pipe '/dev/xconsole' There is for sure no /dev/xconsole on my machine, which explains the problem. I tried invoking the "xconsole" command which made a similar complaint. Then I found this: askubuntu.com/questions/108924/… So I tried that, checks ok. Reboot.. – Monet's Chemist Jan 31 '13 at 17:44
  • ... and I have syslog back! ¡¡¡ Fantastic !!! thank you very much for the help! The only remaining mystery is what happened to /dev/xconsole... – Monet's Chemist Jan 31 '13 at 17:49

As mentioning above, the solution is to comment out the lines related to /dev/xconsole on the /etc/rsyslog.d/50-default.conf file.

Here's a related thread and how they solve the problem: http://www.linuxquestions.org/questions/linux-general-1/log-files-are-empty-messages-syslog-mail-err-930916/

| improve this answer | |

maybe you can check some *.conf at /etc/rsyslog.d/ that have wrong config. example:

:msg, contains, 'xxxxx' /var/log/x.log

change to

:msg, contains "xxxxx" /var/log/x.log

that's what happened to me.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.