Announcement

Collapse
No announcement yet.

syslog is not running/appearing to work properly

Collapse
This topic is closed.
X
X
 
  • Filter
  • Time
  • Show
Clear All
new posts

    syslog is not running/appearing to work properly

    I run logwatcher which is what led me to uncover this problem.

    For the past couple days, my logwatcher e-mail has gotten smaller, and smaller. When I went to check out syslog, I was presented with this present surprise.
    Code:
    andrew@server:~/Downloads$ date
    Fri Nov 16 13:11:37 EST 2012
    andrew@server:~/Downloads$ cat /var/log/syslog
    andrew@server:~/Downloads$ ls -l /var/log/syslog*
    -rw-r----- 1 syslog adm     0 Nov 16 07:37 /var/log/syslog
    -rw-r----- 1 syslog adm    20 Nov 15 07:36 /var/log/syslog.1.gz
    -rw-r----- 1 syslog adm    20 Nov 14 07:43 /var/log/syslog.2.gz
    -rw-r----- 1 syslog adm    20 Nov 13 07:39 /var/log/syslog.3.gz
    -rw-r----- 1 syslog adm    20 Nov 12 07:40 /var/log/syslog.4.gz
    -rw-r----- 1 syslog adm 84817 Nov 12 07:39 /var/log/syslog.5.gz
    -rw-r----- 1 syslog adm 94447 Nov 11 07:53 /var/log/syslog.6.gz
    -rw-r----- 1 syslog adm 15198 Nov 10 07:57 /var/log/syslog.7.gz
    andrew@server:~/Downloads$
    I upgraded to 12.10 on Saturday/Sunday.

    So I attempted to look at dmesg, well, dmesg reports things correctly. So I looked at daemon.log, mail.*, messages, ufw.log, and user.log. All are empty, and have been for the past couple days, or haven't ran a new file since the 12th of November.

    So I listed off the packages that had syslog in the name:
    Code:
    andrew@server:~/Downloads$ dpkg -l | grep syslog
    rc  inetutils-syslogd                        2:1.8-6                                      amd64        system logging daemon
    ii  rsyslog                                  5.8.6-1ubuntu9                               amd64        reliable system and kernel logging daemon
    I thought, okay, well, I will double check inetutils-syslogd and try to reinstall it and rsyslog:

    Code:
    andrew@server:~/Downloads$ sudo apt-get install inetutils-syslogd rsyslog
    Reading package lists... Done
    Building dependency tree       
    Reading state information... Done
    rsyslog is already the newest version.
    Some packages could not be installed. This may mean that you have
    requested an impossible situation or if you are using the unstable
    distribution that some required packages have not yet been created
    or been moved out of Incoming.
    The following information may help to resolve the situation:
    
    The following packages have unmet dependencies:
     inetutils-syslogd : Conflicts: linux-kernel-log-daemon
                         Conflicts: system-log-daemon
     rsyslog : Conflicts: linux-kernel-log-daemon
               Conflicts: system-log-daemon
    E: Unable to correct problems, you have held broken packages.
    So, then I thought I would just install syslogd:
    Code:
    andrew@server:~/Downloads$ sudo apt-get install inetutils-syslogd 
    Reading package lists... Done
    Building dependency tree       
    Reading state information... Done
    The following packages will be REMOVED:
      rsyslog ubuntu-minimal
    The following NEW packages will be installed:
      inetutils-syslogd
    0 upgraded, 1 newly installed, 2 to remove and 0 not upgraded.
    Need to get 58.7 kB of archives.
    After this operation, 1,027 kB disk space will be freed.
    Do you want to continue [Y/n]? 
    Get:1 http://us.archive.ubuntu.com/ubuntu/ quantal/universe inetutils-syslogd amd64 2:1.9-1 [58.7 kB]
    Fetched 58.7 kB in 0s (295 kB/s)       
    (Reading database ... 177144 files and directories currently installed.)
    Removing ubuntu-minimal ...
    dpkg: rsyslog: dependency problems, but removing anyway as you requested:
     inetutils-telnetd depends on inetutils-syslogd | system-log-daemon; however:
      Package inetutils-syslogd is not installed.
      Package system-log-daemon is not installed.
      Package rsyslog which provides system-log-daemon is to be removed.
      Package inetutils-syslogd which provides system-log-daemon is not installed.
     inetutils-talkd depends on inetutils-syslogd | system-log-daemon; however:
      Package inetutils-syslogd is not installed.
      Package system-log-daemon is not installed.
      Package rsyslog which provides system-log-daemon is to be removed.
      Package inetutils-syslogd which provides system-log-daemon is not installed.
     inetutils-ftpd depends on inetutils-syslogd | system-log-daemon; however:
      Package inetutils-syslogd is not installed.
      Package system-log-daemon is not installed.
      Package rsyslog which provides system-log-daemon is to be removed.
      Package inetutils-syslogd which provides system-log-daemon is not installed.
     inetu
    Removing rsyslog ...
    rsyslog stop/waiting
    Processing triggers for ureadahead ...
    Processing triggers for man-db ...
    Selecting previously unselected package inetutils-syslogd.
    (Reading database ... 177102 files and directories currently installed.)
    Unpacking inetutils-syslogd (from .../inetutils-syslogd_2%3a1.9-1_amd64.deb) ...
    Processing triggers for ureadahead ...
    Processing triggers for man-db ...
    Setting up inetutils-syslogd (2:1.9-1) ...
     * Starting system log daemon syslogd
    I really need some help in making sure everything is working correctly after this latest update. It seems to have broken quite a few different things, and I am not sure what else might be broken/missing because of it. At the moment, I don't know if syslog is really running correctly. Or if any of the other things I log (DHCP, DNS, Apache, etc) are working either, as that was the main reason I use logwatcher was to e-mail me results from those.

    #2
    inetutils-syslogd and rsyslog conflict with each other, they can't both be installed at the same time. And to add to the confusion, system-log-daemon and linux-kernel-log-daemon are virtual packages that point to all available sysloggers, but the various dependencies are structured in a way that makes the virtual packages abide by the only-one-logger restriction.

    On my machine, only rsyslog is installed, which is the Ubuntu default. Your dpkg output shows that inetutils-syslogd was installed at one time, but then removed. Do you recall why you might have installed that?

    Let's at least return you to the default. Don't worry if some of the rm commands fail -- I'm erring on the side of caution, and having you remove any residual config files that might exist.

    Code:
    sudo apt-get purge inetutils-syslogd
    sudo rm -rfv /etc/rsyslog.conf /etc/rsyslog.d /etc/default/rsyslog /etc/init/rsyslog.conf /etc/init.d/rsyslog
    sudo apt-get install rsyslog ubuntu-minimal
    Reboot your computer. If your syslog doesn't resume filling up, then we have additional troubleshooting to perform.

    Comment

    Working...
    X