Log files not working

[smartboyhw]

I'm a bit mystified...Why is the tag [Lubuntu]? This is about server, isn't it?

[nothingspecial]

Prefix changed from lubuntu to ubuntu.

[Catalyph]

user@Vault:~$ sudo service rsyslog status
[sudo] password for user:
rsyslog start/running, process 758
user@Vault:~$ lss /etc/ | grep rsys
-rw-r--r--   1 root root                1.2K 2011-06-17 13:13 rsyslog.conf
drwxr-xr-x   2 root root                4.0K 2012-04-15 19:26 rsyslog.d

user@Vault:~$ lss /etc/rsyslog.d
total 16K
drwxr-xr-x  2 root root 4.0K 2012-04-15 19:26 .
drwxr-xr-x 93 root root 4.0K 2012-08-16 14:25 ..
-rw-r--r--  1 root root  311 2011-07-18 18:30 20-ufw.conf
-rw-r--r--  1 root root 1.6K 2012-04-15 19:26 50-default.conf

[Catalyph]

Server is still not logging anything. still have a 0 size auth.log file.

although the rsyslog service is running and it does have .config files....

[Catalyph]

bump

[koenn]

suggestion :


temporarily replace your config file with one that only contains something like

*.*   /var/log/test.log

this should send any logging to the filer mentioned.

don't forget to restart rsyslog, so it'll read the modified config

then, force a logging event by running something like

logger -p daemon.info "test"

this should put an entry in the logfile.


see what you get, take it from there.

[koenn]

see also:
http://ubuntuforums.org/showthread.php?p=12177629

[cholericfun]

Just having the same problem, hope its a bug and not a feature from the producer of the last entry

neither getting ssh logins nor anacron job or other sudo uses

sshd_config has

# Logging
SyslogFacility AUTH
LogLevel INFO

last entry:

Aug 24 00:57:58 PC_NAME sshd[23336]: Did not receive identification string from 123.189.4.148

i set up sshd to only allow myself to login, maybe the username was too easy to guess. Also the port wasnt standard - at least to the outside.

taken the sshd off the port-forwading for now but somehow my X11 got screwed up...


Thinking back i uninstalles some of the unity stuff on this 12.04 machine, using gnome now.
Logs seem to have been working until shutdown, Not afterwards.

[cholericfun]

Hi,
i didnt have any entries in auth.log and realized the permission have changed somehow (how is rather mysterious to me)

ll auth.log

was:

-rw-r----- 1 root root 0 Aug 25 11:26 auth.log

changed to

-rw-r----- 1 syslog root 619 Aug 25 11:26 auth.log

and immediatly fills up.
Anyone any ideas if this is indeed the right ownership of the file and why it could have changed (i installed and removed DesktopEnv related things, shouldnt be interfering with rsyslog)

[LHammonds]

Anyone any ideas if this is indeed the right ownership of the file and why it could have changed (i installed and removed DesktopEnv related things, shouldnt be interfering with rsyslog)

I have Ubuntu Server 12.04 LTS (64-bit) installed and this is the permission settings on my file:

-rw-r----- 1 syslog adm 61804 Aug 25 10:34 auth.log

I verified it is the same on 5 other 12.04 servers I have running as well as 2 servers running 10.04.

As for ideas on how it changed, my initial thought would be that somebody issued a chown command using the recursive -R incorrectly.

Take a look by typing ls -l /var/log and see if everything was set to root:root. There should be many files set to syslog:adm and some set to root:utmp and root:root

LHammonds