Quantcast
Channel: Active questions tagged config - Stack Overflow
Viewing all articles
Browse latest Browse all 5049

rsyslog server stopped writing logs to /var/log/%HOSTNAME%/syslog

$
0
0

I'm working on an rsyslog configuration and suddenly I'm no longer getting writes to /var/log/%HOSTNAME%/syslog. It was working just fine but at some point I deleted the /var/log/%HOSTNAME%/syslog file, and after that nothing was being written. The RemoteLogs template I have in rsyslog.conf is working, so maybe that's overwriting the syslog rule. If that was the case, I'd imagine auth.log and kern.log would also not be working, but they are. I tried removing that line but it didn't change anything.

Here is my server config:

##                       For more information see#                       /usr/share/doc/rsyslog-doc/html/rsyslog_conf.html##  Default logging rules can be found in /etc/rsyslog.d/50-default.conf$template RemoteLogs,"/var/log/%HOSTNAME%/forwarded-logs.log"*.* -?RemoteLogs##################### MODULES #####################module(load="imuxsock") # provides support for local system logging#module(load="immark")  # provides --MARK-- message capability# provides UDP syslog receptionmodule(load="imudp")input(type="imudp" port="514")# provides TCP syslog receptionmodule(load="imtcp")input(type="imtcp" port="514")# provides kernel logging support and enable non-kernel klog messagesmodule(load="imklog" permitnonkernelfacility="on")############################### GLOBAL DIRECTIVES ################################# Use traditional timestamp format.# To enable high precision timestamps, comment out the following line.#$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat# Filter duplicated messages$RepeatedMsgReduction on## Set the default permissions for all log files.#$FileOwner syslog$FileGroup adm$FileCreateMode 0640$DirCreateMode 0755$Umask 0022$PrivDropToUser syslog$PrivDropToGroup syslog## Where to place spool and state files#$WorkDirectory /var/spool/rsyslog## Include all config files in /etc/rsyslog.d/#$IncludeConfig /etc/rsyslog.d/*.conf

My 50-default.conf with more granular rules:

$template AuthLog, "/var/log/%HOSTNAME%/auth.log"auth,authpriv.*                 -?AuthLog$template Syslog, "/var/log/%HOSTNAME%/syslog"*.*;auth,authpriv.none          -?Syslog$template KernelLog, "/var/log/%HOSTNAME%/kern.log"kern.*                          -?KernelLog#lpr.*                          -/var/log/lpr.log$template MailLog, "/var/log/%HOSTNAME%/mail.log"mail.*                          -?MailLog

I'm sure there's a better way I can write that file, so any advice on that would be helpful (I'm brand new to rsyslog)


Viewing all articles
Browse latest Browse all 5049

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>