I wrote:
>I have eight machines, three laptops, three desktops, and two virtual,
>all running Fedora 38, fully updated. All of them include systemd,
>of course, and all are also running rsyslog. Seven of them update
>log files in /var/log as configured by rsyslog.conf, one does not. I
>can't find *any* difference in the configuration between that one
>and the others.
>I've looked at rsyslog.conf and the systemd service files for rsyslog
>and systemd-journald. I've checked the active systemd units and,
>while there are differences, none that seem relevant (mostly different
>devices, etc).
>When I say there are no logs in /var/log, I really mean that they are
>empty. /var/log/messages, for example, does contain about 900 lines
>from the last time the machine was rebooted but nothing else. After
>logrotate runs, /var/log/messages is completely empty. Other empty
>files include boot.log, cron, maillog, sa-update.log, secure, spooler,
>and all the logs in the anaconda, cups, httpd, and sssd subdirectories.
>What else can I check to see why this one machine doesn't get the logs?
Brad Van Orden wrote:
>I would check and make sure rsyslogd is running:
Yes, it is running.
>systemctl cat rsyslog
>Look for the EnvironmentFile line. Check the contents of that file and
>make sure they make sense.
The EnvironmentFile is /etc/sysconfig/rsyslog, it is identical on all
eight machines, and it is the original file from Fedora. The only non-
comment line in it is,
SYSLOGD_OPTIONS=""
David Lang wrote:
>if you post the configs we can make guesses.
>
>if the rsyslog instances are not using imjournal, then you are
>depending on systemd sending logs to the non-standard place that they
>define and rsyslog listening on that same non-standard place instead
>of the standard /dev/log (systemd insists on taking over /dev/log)
I have made no customization changes to journald on any of the eight
machines. There are some changes in rsyslog.conf on other machines but
not on the misbehaving one. On the misbehaving machine, no files from
the package rsyslog-8.2306.0-1.fc38.x86_64.rpm have changed. This
includes /usr/lib/systemd/system/rsyslog.service, /etc/rsyslog.conf,
and /etc/sysconfig/rsyslog. Every file I know of which seems relevant
has been compared to the seven working machines and I can't find any
unexpected differences. For most of the working machines, the files
are identical.
To me, the fact that boot messages, but nothing after, make it into
/var/log/messages seems like it ought to be significant. The last two
lines recorded are,
systemd[1]: Switching root.
systemd-journald[205]: Journal stopped
But those lines also appear after boot on the other machines and the
log then continues without even a gap in time.
--
Dave Close, Compata, Irvine CA +1 714 434 7359
d...@compata.com dhcl...@alumni.caltech.edu
"Reality leaves a lot to the imagination." -- John Lennon
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
