I'm a bit mystified...Why is the tag [Lubuntu]? This is about server, isn't it?
Printable View
I'm a bit mystified...Why is the tag [Lubuntu]? This is about server, isn't it?
Prefix changed from lubuntu to ubuntu.
Code:user@Vault:~$ sudo service rsyslog status
[sudo] password for user:
rsyslog start/running, process 758
user@Vault:~$ lss /etc/ | grep rsys
-rw-r--r-- 1 root root 1.2K 2011-06-17 13:13 rsyslog.conf
drwxr-xr-x 2 root root 4.0K 2012-04-15 19:26 rsyslog.d
user@Vault:~$ lss /etc/rsyslog.d
total 16K
drwxr-xr-x 2 root root 4.0K 2012-04-15 19:26 .
drwxr-xr-x 93 root root 4.0K 2012-08-16 14:25 ..
-rw-r--r-- 1 root root 311 2011-07-18 18:30 20-ufw.conf
-rw-r--r-- 1 root root 1.6K 2012-04-15 19:26 50-default.conf
Server is still not logging anything. still have a 0 size auth.log file.
although the rsyslog service is running and it does have .config files....
bump
suggestion :
temporarily replace your config file with one that only contains something like
this should send any logging to the filer mentioned.Code:*.* /var/log/test.log
don't forget to restart rsyslog, so it'll read the modified config
then, force a logging event by running something like
this should put an entry in the logfile.Code:logger -p daemon.info "test"
see what you get, take it from there.
Just having the same problem, hope its a bug and not a feature from the producer of the last entry
neither getting ssh logins nor anacron job or other sudo uses
sshd_config has
last entry:Code:# Logging
SyslogFacility AUTH
LogLevel INFO
i set up sshd to only allow myself to login, maybe the username was too easy to guess. Also the port wasnt standard - at least to the outside.Quote:
Aug 24 00:57:58 PC_NAME sshd[23336]: Did not receive identification string from 123.189.4.148
taken the sshd off the port-forwading for now but somehow my X11 got screwed up...
Thinking back i uninstalles some of the unity stuff on this 12.04 machine, using gnome now.
Logs seem to have been working until shutdown, Not afterwards.
Hi,
i didnt have any entries in auth.log and realized the permission have changed somehow (how is rather mysterious to me)
was:Code:ll auth.log
changed toCode:-rw-r----- 1 root root 0 Aug 25 11:26 auth.log
and immediatly fills up.Code:-rw-r----- 1 syslog root 619 Aug 25 11:26 auth.log
Anyone any ideas if this is indeed the right ownership of the file and why it could have changed (i installed and removed DesktopEnv related things, shouldnt be interfering with rsyslog)
I have Ubuntu Server 12.04 LTS (64-bit) installed and this is the permission settings on my file:
I verified it is the same on 5 other 12.04 servers I have running as well as 2 servers running 10.04.Code:-rw-r----- 1 syslog adm 61804 Aug 25 10:34 auth.log
As for ideas on how it changed, my initial thought would be that somebody issued a chown command using the recursive -R incorrectly.
Take a look by typing ls -l /var/log and see if everything was set to root:root. There should be many files set to syslog:adm and some set to root:utmp and root:root
LHammonds