Home / ubuntu / Questions / 790601
Accepted
balping
Asked: 2016-06-24 04:02:14 +0800 CST

Accidentally deleted /var/log/syslog

  • 772

I accidentally deleted /var/log/syslog and now I can't get rsyslog working.

I was googling, I tried everything I found. To be precise:

I created syslog with touch.

Then I set chmod and chown correctly. Now ls -al gives this result:

-rw-r-----  1 syslog            adm           0 jún   23 02:36 syslog
-rw-r-----  1 syslog            adm     1557257 jún   23 01:33 syslog.1
-rw-r-----  1 syslog            adm      156618 jún   22 07:51 syslog.2.gz
-rw-r-----  1 syslog            adm      155851 jún   21 07:45 syslog.3.gz
-rw-r-----  1 syslog            adm      155199 jún   20 07:35 syslog.4.gz
-rw-r-----  1 syslog            adm      159709 jún   19 07:37 syslog.5.gz
-rw-r-----  1 syslog            adm      156035 jún   18 07:52 syslog.6.gz
-rw-r-----  1 syslog            adm      158478 jún   17 07:55 syslog.7.gz

Then I restarted rsyslog service:

service rsyslog restart

I rebooted the system several times.

I even re-installed rsyslog with apt-get purge and apt-get install

But none of these helped me. As you can see above, syslog still has a length of 0 bytes, nothing gets logged.

Edit:

Even when I'm trying to log something manually, nothing gets logged:

# ls -al /var/log/syslog
-rw-r----- 1 syslog adm 0 jún   23 14:04 /var/log/syslog
# logger "this message should end up in syslog"
# ls -al /var/log/syslog
-rw-r----- 1 syslog adm 0 jún   23 14:04 /var/log/syslog

Permissions of /var and /var/log:

# ls -al /var
drwxr-xr-x 14 root root     4096 dec   16  2015 .
drwxr-xr-x 24 root root     4096 máj   31 14:14 ..
...
drw-rw---- 22 root syslog   4096 jún   23 14:05 log

I'm on ubuntu 14.04

14.04

2 Answers

  1. Best Answer

    As @Rinzwind pointed out: the permissions on the /var/log directory may have accidentally been changed. In a fresh install they are drwxrwxr-x.

    Change your permissions:

    # chmod 775 /var/log

    and # systemctl restart rsyslog (or reboot). Test the syslog facility with:

    $ logger "this message should end up in syslog"

    • 12

  2. Same problem with server Ubuntu 16.04 LTS. I deleted /var/log/syslog.

    Problem is the OWNER / Group of the syslog file !

    Solution :

    1. create an empty syslog file
    2. With Ubuntu 16.04, the owner group must be syslog:adm
    3. restart
    4. test with logger

    Commands:

    cd /var/log
touch syslog
chown syslog:adm syslog
service rsyslog restart
logger "Didier MISSON logger test"

    You must see the message in the syslog:

    less syslog
    • 7