Re: Help ! No syslog anymore

From	Bhasker C V <bhasker@unixindia.com>
Newsgroups	linux.debian.user
Subject	Re: Help ! No syslog anymore
Date	2023-11-16 12:50 +0100
Message-ID	<HAJ2F-5ORW-7@gated-at.bofh.it> (permalink)
References	(1 earlier) <HzcVc-4Q5W-3@gated-at.bofh.it> <HzcVc-4Q5W-1@gated-at.bofh.it> <HzBgR-556A-9@gated-at.bofh.it> <HzBgR-556A-7@gated-at.bofh.it> <HAJ2F-5ORW-9@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

Michael,
You are a star.
I dont know what I did before but I re-installed rsyslog and changed the
PrivateTmp to no
It works now.
I can see /tmp/server.log is now pushing syslog contents
Thank you very much.

On Mon, Nov 13, 2023 at 10:24 AM Michael Biebl <biebl@debian.org> wrote:

> Am 13.11.23 um 10:13 schrieb Bhasker C V:
> > I forgot to answer the question on why I am doing this
> > I am experimenting on a no-log system where there is no writes
> > what-so-ever to /var/log (except for mails) or systemd journal
> > (currently kept volatile)
> > /tmp/ is tmpfs mounted
> > Attached is the rsyslog config as-it-is being used now.
> >
>
> With the attached rsyslog.conf, disabling PrivateTmp makes rsyslog log
> to /run/server.log correctly (verified locally).
>
> I can only assume you didn't follow my instructions properly.
>
> Please make sure after following my instruction that you have afterwards
> # systemctl show -P PrivateTmp rsyslog.service
> no
>
> Btw, for your use case, a subdirectory in /run would be more suitable,
> like say /run/syslog/.
>
> Also, you currently have
> *.*                             -/tmp/server.log
> *and*
> *.=info;*.=notice;*.=warn;\
>         auth,authpriv.none;\
>         cron,daemon.none;\
>         mail,audit,news.none            -/tmp/server.log
>
> This doesn't make any sense.
> This will basically duplicate the log messages in /tmp/server.log and
> interleave them.
>
> Either you split up the logs facilities and log them to separate files
> or you only keep a single log rule like
>
> *.*                             -/tmp/server.log
>
> which simply logs everything to /tmp/server.log
>
>

Back to linux.debian.user | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

Help ! No syslog anymore Bhasker C V <bhasker@unixindia.com> - 2023-11-08 09:30 +0100
  Re: Help ! No syslog anymore Sven Joachim <svenjoac@gmx.de> - 2023-11-08 17:50 +0100
    Re: Help ! No syslog anymore Bhasker C V <bhasker@unixindia.com> - 2023-11-10 09:10 +0100
      Re: Help ! No syslog anymore Bhasker C V <bhasker@unixindia.com> - 2023-11-12 08:20 +0100
        Re: Help ! No syslog anymore Bhasker C V <bhasker@unixindia.com> - 2023-11-16 12:50 +0100

csiph-web