I would check and make sure rsyslogd is running: systemctl is-enabled rsyslog systemctl status -l rsyslog
To see where your environment file is, run: systemctl cat rsyslog Look for the EnvironmentFile line. Check the contents of that file and make sure they make sense. On Wed, Jun 28, 2023 at 11:38 PM David Lang via rsyslog < rsyslog@lists.adiscon.com> wrote: > if you post the configs we can make guesses. > > if the rsyslog instances are not using imjournal, then you are depending > on > systemd sending logs to the non-standard place that they define and > rsyslog > listening on that same non-standard place instead of the standard /dev/log > (systemd insists on taking over /dev/log) > > David Lang > > On Wed, 28 Jun 2023, Dave Close via rsyslog wrote: > > > Date: Wed, 28 Jun 2023 20:00:28 -0700 > > From: Dave Close via rsyslog <rsyslog@lists.adiscon.com> > > To: rsyslog@lists.adiscon.com > > Cc: Dave Close <d...@compata.com> > > Subject: [rsyslog] rsyslog vs systemd > > > > I have eight machines, three laptops, three desktops, and two virtual, > > all running Fedora 38, fully updated. All of them include systemd, > > of course, and all are also running rsyslog. Seven of them update > > log files in /var/log as configured by rsyslog.conf, one does not. I > > can't find *any* difference in the configuration between that one > > and the others. > > > > I've looked at rsyslog.conf and the systemd service files for rsyslog > > and systemd-journald. I've checked the active systemd units and, > > while there are differences, none that seem relevant (mostly different > > devices, etc). > > > > When I say there are no logs in /var/log, I really mean that they are > > empty. /var/log/messages, for example, does contain about 900 lines > > from the last time the machine was rebooted but nothing else. After > > logrotate runs, /var/log/messages is completely empty. Other empty > > files include boot.log, cron, maillog, sa-update.log, secure, spooler, > > and all the logs in the anaconda, cups, httpd, and sssd subdirectories. > > > > Most of the time, of course, I don't even notice this issue. But when > > I want to dianose a problem, it becomes a real headache. I'm really not > > good with journalctl syntax, though I'm learning. Most of the time, I'd > > really prefer to read plain text logs. > > > > What else can I check to see why this one machine doesn't get the logs? > > > _______________________________________________ > rsyslog mailing list > https://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list https://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
