6

I accidentally deleted /var/log/syslog and now I can't get rsyslog working.

I was googling, I tried everything I found. To be precise:

I created syslog with touch.

Then I set chmod and chown correctly. Now ls -al gives this result:

-rw-r-----  1 syslog            adm           0 jún   23 02:36 syslog
-rw-r-----  1 syslog            adm     1557257 jún   23 01:33 syslog.1
-rw-r-----  1 syslog            adm      156618 jún   22 07:51 syslog.2.gz
-rw-r-----  1 syslog            adm      155851 jún   21 07:45 syslog.3.gz
-rw-r-----  1 syslog            adm      155199 jún   20 07:35 syslog.4.gz
-rw-r-----  1 syslog            adm      159709 jún   19 07:37 syslog.5.gz
-rw-r-----  1 syslog            adm      156035 jún   18 07:52 syslog.6.gz
-rw-r-----  1 syslog            adm      158478 jún   17 07:55 syslog.7.gz

Then I restarted rsyslog service:

service rsyslog restart

I rebooted the system several times.

I even re-installed rsyslog with apt-get purge and apt-get install

But none of these helped me. As you can see above, syslog still has a length of 0 bytes, nothing gets logged.

Edit:

Even when I'm trying to log something manually, nothing gets logged:

# ls -al /var/log/syslog
-rw-r----- 1 syslog adm 0 jún   23 14:04 /var/log/syslog
# logger "this message should end up in syslog"
# ls -al /var/log/syslog
-rw-r----- 1 syslog adm 0 jún   23 14:04 /var/log/syslog

Permissions of /var and /var/log:

# ls -al /var
drwxr-xr-x 14 root root     4096 dec   16  2015 .
drwxr-xr-x 24 root root     4096 máj   31 14:14 ..
...
drw-rw---- 22 root syslog   4096 jún   23 14:05 log

I'm on ubuntu 14.04

  • 2
    Try logger "this message should end up in syslog". Then see if that gets logged. – Jos Jun 23 '16 at 12:04
  • @Jos Now I tried it, nothing – balping Jun 23 '16 at 12:06
  • Is rsyslog running? What does sudo service rsyslog status say? – Jos Jun 23 '16 at 12:11
  • @Jos rsyslog start/running, process 513 – balping Jun 23 '16 at 12:12
  • 3
    did you perhaps change permissions of either /var or /var/log/? is /var on a partition and full? start rsyslog manually under strace and see if it complains – Rinzwind Jun 23 '16 at 12:13
3

As @Rinzwind pointed out: the permissions on the /var/log directory may have accidentally been changed. In a fresh install they are drwxrwxr-x.

Change your permissions:

chmod 775 /var/log

and restart rsyslog (or reboot). Test the syslog facility with:

logger "this message should end up in syslog"

5

Same problem with server Ubuntu 16.04 LTS. I deleted /var/log/syslog.

Problem is the OWNER / Group of the syslog file !

Solution :

  1. create an empty syslog file
  2. With Ubuntu 16.04, the owner group must be syslog:adm
  3. restart
  4. test with logger

Commands:

cd /var/log
touch syslog
chown syslog:adm syslog
service rsyslog restart
logger "Didier MISSON logger test"

You must see the message in the syslog:

less syslog

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.