I wrote:
I have eight machines, three laptops, three desktops, and two virtual,
all running Fedora 38, fully updated. All of them include systemd,
of course, and all are also running rsyslog. Seven of them update
log files in /var/log as configured by rsyslog.conf, one does not. I
can't find *any* difference in the configuration between that one
and the others.
I've looked at rsyslog.conf and the systemd service files for rsyslog
and systemd-journald. I've checked the active systemd units and,
while there are differences, none that seem relevant (mostly different
devices, etc).
When I say there are no logs in /var/log, I really mean that they are
empty. /var/log/messages, for example, does contain about 900 lines
from the last time the machine was rebooted but nothing else. After
logrotate runs, /var/log/messages is completely empty. Other empty
files include boot.log, cron, maillog, sa-update.log, secure, spooler,
and all the logs in the anaconda, cups, httpd, and sssd subdirectories.
What else can I check to see why this one machine doesn't get the logs?
Brad Van Orden wrote:
I would check and make sure rsyslogd is running:
Yes, it is running.
systemctl cat rsyslog
Look for the EnvironmentFile line. Check the contents of that file and
make sure they make sense.
The EnvironmentFile is /etc/sysconfig/rsyslog, it is identical on all
eight machines, and it is the original file from Fedora. The only non-
comment line in it is,
SYSLOGD_OPTIONS=""
David Lang wrote:
if you post the configs we can make guesses.
if the rsyslog instances are not using imjournal, then you are
depending on systemd sending logs to the non-standard place that they
define and rsyslog listening on that same non-standard place instead
of the standard /dev/log (systemd insists on taking over /dev/log)
I have made no customization changes to journald on any of the eight
machines. There are some changes in rsyslog.conf on other machines but
not on the misbehaving one. On the misbehaving machine, no files from
the package rsyslog-8.2306.0-1.fc38.x86_64.rpm have changed. This
includes /usr/lib/systemd/system/rsyslog.service, /etc/rsyslog.conf,
and /etc/sysconfig/rsyslog. Every file I know of which seems relevant
has been compared to the seven working machines and I can't find any
unexpected differences. For most of the working machines, the files
are identical.
To me, the fact that boot messages, but nothing after, make it into
/var/log/messages seems like it ought to be significant. The last two
lines recorded are,
systemd[1]: Switching root.
systemd-journald[205]: Journal stopped
But those lines also appear after boot on the other machines and the
log then continues without even a gap in time.
