no log in Red Hat EL7.2

Everything related with getting rsyslog up and running (but not beyond that point ;))

Moderator: rgerhards

Google Ads


no log in Red Hat EL7.2

Postby flaco » Fri Jan 08, 2016 1:53 pm

Hello,

installling rsyslog-8.15.0 in Red Hat EL7 no log is written.
My system is:

Code: Select all
Red Hat Enterprise Linux Server release 7.2 (Maipo)
Linux 04ucas.csi.it 3.10.0-327.4.4.el7.x86_64 #1 SMP Thu Dec 17 15:51:24 EST 2015 x86_64 x86_64 x86_64 GNU/Linux

rsyslogd 8.15.0, compiled with:
        PLATFORM:                               x86_64-redhat-linux-gnu
        PLATFORM (lsb_release -d):
        FEATURE_REGEXP:                         Yes
        GSSAPI Kerberos 5 support:              No
        FEATURE_DEBUG (debug build, slow code): No
        32bit Atomic operations supported:      Yes
        64bit Atomic operations supported:      Yes
        memory allocator:                       system default
        Runtime Instrumentation (slow code):    No
        uuid support:                           Yes
        Number of Bits in RainerScript integers: 64


The debug output is attached.
The starting rsyslog row is the only written to syslog. If I send:

logger -p local1.info "prova dfkslk kldfjsdklfjskl"

the message is not written to syslog and no debug is shown in rsyslog.

Could you help me?
Thank you very much
Best Regards
Marco
Attachments
rsyslog.conf.txt
configuration file
(3.12 KiB) Downloaded 128 times
debug.txt
rsyslog -d -n
(125.64 KiB) Downloaded 129 times
flaco
Advanced
 
Posts: 35
Joined: Thu Sep 20, 2007 10:23 am

Urgent Question?

  • Pulling out your Hair?
  • Wasting Time and Money?
  • Deadline Approaching?

Re: no log in Red Hat EL7.2

Postby dlang » Sun Jan 10, 2016 9:40 am

I would guess that the sytemd journal is intercepting things and not sending them on to rsyslog. did you check to see if the logs was in the journal?
dlang
Frequent Poster
 
Posts: 1001
Joined: Mon Sep 15, 2008 7:44 am

Re: no log in Red Hat EL7.2

Postby flaco » Mon Jan 11, 2016 11:48 am

dlang wrote:I would guess that the sytemd journal is intercepting things and not sending them on to rsyslog. did you check to see if the logs was in the journal?

Yes, the journal contains the log lines.
flaco
Advanced
 
Posts: 35
Joined: Thu Sep 20, 2007 10:23 am

Re: no log in Red Hat EL7.2

Postby dlang » Mon Jan 11, 2016 8:05 pm

Then I suspect that your problem is that the systemd journal is not delivering logs to rsyslog, check it's config.
dlang
Frequent Poster
 
Posts: 1001
Joined: Mon Sep 15, 2008 7:44 am

Re: no log in Red Hat EL7.2

Postby flaco » Tue Jan 12, 2016 11:16 am

dlang wrote:Then I suspect that your problem is that the systemd journal is not delivering logs to rsyslog, check it's config.


I never changed the journal config from its default. I see that after upgrade the journald.conf didn't change.
I'm trying to get RH support, but they provide not specific help. First, they say to configure persistent journal storage; after they suggest to configure imjournal module instead.

Really, if I understand well, it seems that if I see log with journalctl, rsyslog should read them.
Before change configuration from default provided by RH installation, could you help me to understand if this is a journal problem and not a rsyslog problem?

What is the best configuration for rsyslog and plain log messages? imjournal or the default configured with RH?

Thank you very much again
Marco
flaco
Advanced
 
Posts: 35
Joined: Thu Sep 20, 2007 10:23 am

Re: no log in Red Hat EL7.2

Postby rgerhards » Tue Jan 12, 2016 11:43 am

imjournal actually is the RH default nowadays. At some point, they have switched off forwarding message from the journal to rsyslog, so rsyslog now need to pull them from the journal. I don't know when exactly this change did happen.

HTH
Rainer
rgerhards
Site Admin
 
Posts: 3807
Joined: Thu Feb 13, 2003 11:57 am

Re: no log in Red Hat EL7.2

Postby flaco » Tue Jan 12, 2016 11:55 am

rgerhards wrote:imjournal actually is the RH default nowadays. At some point, they have switched off forwarding message from the journal to rsyslog, so rsyslog now need to pull them from the journal. I don't know when exactly this change did happen.

HTH
Rainer


I confirm that from 7.1 to 7.2 update, journal.conf changed default from
ForwardToSyslog=yes
to
ForwardToSyslog=no

but my rsyslog.conf didn't change accordingly during upgrade ;) I'll adjust my rsyslog.conf as needed.
I need to remember this when I update from 7.1 to 7.2.

Is structured data the only reason to use imjournal?
I read that "Only if that structured data is needed, imjournal must be used". I don't use structured data, so I think it's better for me to keep the Forward method.

Thank you very much.
Bye
Marco
flaco
Advanced
 
Posts: 35
Joined: Thu Sep 20, 2007 10:23 am

Re: no log in Red Hat EL7.2

Postby rgerhards » Tue Jan 12, 2016 12:16 pm

IIRC, RH had some problems witht he journal loosing messages under high pressure. In contrast to the standard logging API, it does not buffer or wait for messages to be consumed. Not 100% sure, though.
rgerhards
Site Admin
 
Posts: 3807
Joined: Thu Feb 13, 2003 11:57 am

Re: no log in Red Hat EL7.2

Postby dlang » Tue Jan 12, 2016 7:25 pm

I have seen that there is a way to configure the systemd journal to not take over /dev/log so that rsyslog can operate normally rather than the logs going through the journal first. But the systemd people would like to pretend this isn't possible (except when they are called out on it), and so finding it in documentation is harder than it should be.
dlang
Frequent Poster
 
Posts: 1001
Joined: Mon Sep 15, 2008 7:44 am

Re: no log in Red Hat EL7.2

Postby flaco » Wed Jan 13, 2016 1:07 pm

Just for info... Red Hat support refuses answer to my question about the preferred method to apply when I don't have structured data.
I installed rsyslog-8.15 and they support only their own rsyslog package as is.

Best Regards
Marco
flaco
Advanced
 
Posts: 35
Joined: Thu Sep 20, 2007 10:23 am

Re: no log in Red Hat EL7.2

Postby dlang » Wed Jan 13, 2016 8:23 pm

makes you wonder where the value is in paying for their "support" ;-)
dlang
Frequent Poster
 
Posts: 1001
Joined: Mon Sep 15, 2008 7:44 am

Google Ads



Return to Installation

Who is online

Users browsing this forum: No registered users and 2 guests

cron