Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #263738 > unrolled thread

in Debian bookworm /var/log/syslog is empty

Back to article view | Back to linux.debian.user

Contents

  in Debian bookworm /var/log/syslog is empty John Covici <covici@ccs.covici.com> - 2023-11-20 23:10 +0100
    Re: in Debian bookworm /var/log/syslog is empty Christoph Brinkhaus <c.brinkhaus@t-online.de> - 2023-11-21 10:40 +0100
      Re: in Debian bookworm /var/log/syslog is empty Marco Moock <mm@dorfdsl.de> - 2023-11-21 11:20 +0100
        Re: in Debian bookworm /var/log/syslog is empty John Covici <covici@ccs.covici.com> - 2023-11-21 14:20 +0100
      Re: in Debian bookworm /var/log/syslog is empty John Covici <covici@ccs.covici.com> - 2023-11-21 11:20 +0100
        Re: in Debian bookworm /var/log/syslog is empty Christoph Brinkhaus <c.brinkhaus@t-online.de> - 2023-11-21 12:00 +0100
        Re: in Debian bookworm /var/log/syslog is empty fxkl47BF@protonmail.com - 2023-11-21 12:30 +0100
        Re: in Debian bookworm /var/log/syslog is empty Dan Ritter <dsr@randomstring.org> - 2023-11-21 12:50 +0100

#263738 — in Debian bookworm /var/log/syslog is empty

Hi.  I am using bookworm with latest updates and /var/log/syslog is
empty, even though rsyslog is runniing.  I am also using logwatch and
not getting at least some responses I should get such as fail2ban.
These may be separate problems, but any help on those would be
appreciated.  I saw a previous thread, but it does not seem to apply
to my situation.

-- 
Your life is like a penny.  You're going to lose it.  The question is:
How do
you spend it?

         John Covici wb2una
         covici@ccs.covici.com

[toc] | [next] | [standalone]

#263750

[Multipart message — attachments visible in raw view] — view raw

Am Mon, Nov 20, 2023 at 05:01:50PM -0500 schrieb John Covici:
> Hi.  I am using bookworm with latest updates and /var/log/syslog is
> empty, even though rsyslog is runniing.  I am also using logwatch and
> not getting at least some responses I should get such as fail2ban.
> These may be separate problems, but any help on those would be
> appreciated.  I saw a previous thread, but it does not seem to apply
> to my situation.

Hi John,
from Bookworm on the default log system has been changed to the
systemd-mechanism only. In the Bookworm release notes is a section about
logging. It describes how to re-enable the conventional logging
facilities. I hope this pointer is helpful.

> Your life is like a penny.  You're going to lose it.  The question is:
> How do
> you spend it?
> 
>          John Covici wb2una
>          covici@ccs.covici.com
> 
This is a very wise statement. Mine is just a joke in German.

Kind regards,
Christoph
-- 
Ist die Katze gesund
schmeckt sie dem Hund.

[toc] | [prev] | [next] | [standalone]

#263751

Am 21.11.2023 um 05:15:24 Uhr schrieb John Covici:

> hmmm, I looked at the release notes, but it does not say how to
> restore the old behavior, it just says many files are no longer
> necessary and lists them.

Please post you syslog configuration.

[toc] | [prev] | [next] | [standalone]

#263756

OK, here it is:

# /etc/rsyslog.conf configuration file for rsyslog
#
# For more information install rsyslog-doc and see
# /usr/share/doc/rsyslog-doc/html/configuration/index.html


#################
#### MODULES ####
#################

module(load="imuxsock") # provides support for local system logging
module(load="imklog")   # provides kernel logging support
#module(load="immark")  # provides --MARK-- message capability

# provides UDP syslog reception
#module(load="imudp")
#input(type="imudp" port="514")

# provides TCP syslog reception
#module(load="imtcp")
#input(type="imtcp" port="514")


###########################
#### GLOBAL DIRECTIVES ####
###########################

#
# Set the default permissions for all log files.
#
$FileOwner root
$FileGroup adm
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022

#
# Where to place spool and state files
#
$WorkDirectory /var/spool/rsyslog

#
# Include all config files in /etc/rsyslog.d/
#
$IncludeConfig /etc/rsyslog.d/*.conf


###############
#### RULES ####
###############

#
# Log anything besides private authentication messages to a single log file
#
*.*;auth,authpriv.none		-/var/log/syslog

#
# Log commonly used facilities to their own log file
#
auth,authpriv.*			/var/log/auth.log
cron.*				-/var/log/cron.log
kern.*				-/var/log/kern.log
mail.*				-/var/log/mail.log
user.*				-/var/log/user.log

#
# Emergencies are sent to everybody logged in.
#
*.emerg				:omusrmsg:*

On Tue, 21 Nov 2023 05:17:55 -0500,
Marco Moock wrote:
> 
> Am 21.11.2023 um 05:15:24 Uhr schrieb John Covici:
> 
> > hmmm, I looked at the release notes, but it does not say how to
> > restore the old behavior, it just says many files are no longer
> > necessary and lists them.
> 
> Please post you syslog configuration.

-- 
Your life is like a penny.  You're going to lose it.  The question is:
How do
you spend it?

         John Covici wb2una
         covici@ccs.covici.com

[toc] | [prev] | [next] | [standalone]

#263752

hmmm, I looked at the release notes, but it does not say how to
restore the old behavior, it just says many files are no longer
necessary and lists them.  I am using logwatch and that program seems
to be effected, I would be OK, if I could get logwatch to work
properly.

On Tue, 21 Nov 2023 04:32:35 -0500,
Christoph Brinkhaus wrote:
> 
> [1  <text/plain; us-ascii (quoted-printable)>]
> Am Mon, Nov 20, 2023 at 05:01:50PM -0500 schrieb John Covici:
> > Hi.  I am using bookworm with latest updates and /var/log/syslog is
> > empty, even though rsyslog is runniing.  I am also using logwatch and
> > not getting at least some responses I should get such as fail2ban.
> > These may be separate problems, but any help on those would be
> > appreciated.  I saw a previous thread, but it does not seem to apply
> > to my situation.
> 
> Hi John,
> from Bookworm on the default log system has been changed to the
> systemd-mechanism only. In the Bookworm release notes is a section about
> logging. It describes how to re-enable the conventional logging
> facilities. I hope this pointer is helpful.
> 
> > Your life is like a penny.  You're going to lose it.  The question is:
> > How do
> > you spend it?
> > 
> >          John Covici wb2una
> >          covici@ccs.covici.com
> > 
> This is a very wise statement. Mine is just a joke in German.
> 
> Kind regards,
> Christoph
> -- 
> Ist die Katze gesund
> schmeckt sie dem Hund.
> [2 signature.asc <application/pgp-signature (7bit)>]
> Verifying...

-- 
Your life is like a penny.  You're going to lose it.  The question is:
How do
you spend it?

         John Covici wb2una
         covici@ccs.covici.com

[toc] | [prev] | [next] | [standalone]

#263753

[Multipart message — attachments visible in raw view] — view raw

Am Tue, Nov 21, 2023 at 05:15:24AM -0500 schrieb John Covici:
> hmmm, I looked at the release notes, but it does not say how to
> restore the old behavior, it just says many files are no longer
> necessary and lists them.  I am using logwatch and that program seems
> to be effected, I would be OK, if I could get logwatch to work
> properly.

I have searched a little bit. The question is if rsyslog is really
properly up and running.
https://www.debian.org/releases/bookworm/amd64/release-notes/ch-information.en.html#changes-to-system-logging
https://www.server-world.info/en/note?os=Debian_12&p=rsyslog
If journalctl does not show any issues related to rsyslog it boils down
to the question raised by Marco.

> 
> On Tue, 21 Nov 2023 04:32:35 -0500,
> Christoph Brinkhaus wrote:
> > 
> > [1  <text/plain; us-ascii (quoted-printable)>]
> > Am Mon, Nov 20, 2023 at 05:01:50PM -0500 schrieb John Covici:
> > > Hi.  I am using bookworm with latest updates and /var/log/syslog is
> > > empty, even though rsyslog is runniing.  I am also using logwatch and
> > > not getting at least some responses I should get such as fail2ban.
> > > These may be separate problems, but any help on those would be
> > > appreciated.  I saw a previous thread, but it does not seem to apply
> > > to my situation.
> > 
> > Hi John,
> > from Bookworm on the default log system has been changed to the
> > systemd-mechanism only. In the Bookworm release notes is a section about
> > logging. It describes how to re-enable the conventional logging
> > facilities. I hope this pointer is helpful.
> > 
> > > Your life is like a penny.  You're going to lose it.  The question is:
> > > How do
> > > you spend it?
> > > 
> > >          John Covici wb2una
> > >          covici@ccs.covici.com
> > > 
> > This is a very wise statement. Mine is just a joke in German.
> > 
> > Kind regards,
> > Christoph
> > -- 
> > Ist die Katze gesund
> > schmeckt sie dem Hund.
> > [2 signature.asc <application/pgp-signature (7bit)>]
> > Verifying...
> 
> -- 
> Your life is like a penny.  You're going to lose it.  The question is:
> How do
> you spend it?
> 
>          John Covici wb2una
>          covici@ccs.covici.com
> 

[toc] | [prev] | [next] | [standalone]

#263754

On Tue, 21 Nov 2023, John Covici wrote:

> hmmm, I looked at the release notes, but it does not say how to
> restore the old behavior, it just says many files are no longer
> necessary and lists them.  I am using logwatch and that program seems
> to be effected, I would be OK, if I could get logwatch to work
> properly.
>


i restored /etc/rsyslogd.conf from bullseye backups
this fixed the bookworm logs screwup and logwatch is ok
debian is just freeware
we have to diddle it sometimes

[toc] | [prev] | [next] | [standalone]

#263755

John Covici wrote: 
> hmmm, I looked at the release notes, but it does not say how to
> restore the old behavior, it just says many files are no longer
> necessary and lists them.  I am using logwatch and that program seems
> to be effected, I would be OK, if I could get logwatch to work
> properly.


rsyslogd.conf controls what logfiles rsyslogd would generate:

*.*			      -/var/log/syslog
auth,authpriv.*         /var/log/auth.log
cron.*             /var/log/cron.log
daemon.*,local7.*       -/var/log/daemon.log
kern.*              -/var/log/kern.log
mail.*              -/var/log/mail.log
user.*              -/var/log/user.log

for example.

Make sure rsyslogd is installed, then read the man page and figure out what you want.

-dsr-

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.user

csiph-web