I just started to learn linux with Ubuntu 18.04. When I was reading the config file for rsyslog: /etc/rsyslog.d/50-default.conf , I found that some of the log file directories are having minus signs at their beginning, like the one I pasted below.
mail.* -/var/log/mail.log
Only auth and cron do not contain any minus sign among their default log file directories. Does this minus sign mean anything special?
Thanks!
Since my update to 18.04.1 last week from 16.04.5 I've been seeing this in my syslog every few minutes:
Aug 19 19:22:02 localhost rsyslogd: action 'action 3' resumed (module 'builtin:omfile') [v8.32.0 try http://www.rsyslog.com/e/2359 ]
Aug 19 19:22:02 localhost rsyslogd: action 'action 3' suspended (module 'builtin:omfile'), retry 0. There should be messages before this one giving the reason for suspension. [v8.32.0 try http://www.rsyslog.com/e/2007 ]
Aug 19 19:22:02 localhost rsyslogd: action 'action 3' resumed (module 'builtin:omfile') [v8.32.0 try http://www.rsyslog.com/e/2359 ]
Aug 19 19:22:02 localhost rsyslogd: action 'action 3' suspended (module 'builtin:omfile'), retry 0. There should be messages before this one giving the reason for suspension. [v8.32.0 try http://www.rsyslog.com/e/2007 ]
Aug 19 19:22:02 localhost rsyslogd: action 'action 3' resumed (module 'builtin:omfile') [v8.32.0 try http://www.rsyslog.com/e/2359 ]
Aug 19 19:22:02 localhost rsyslogd: action 'action 3' suspended (module 'builtin:omfile'), retry 0. There should be messages before this one giving the reason for suspension. [v8.32.0 try http://www.rsyslog.com/e/2007 ]
Aug 19 19:22:02 localhost rsyslogd: action 'action 3' resumed (module 'builtin:omfile') [v8.32.0 try http://www.rsyslog.com/e/2359 ]
Aug 19 19:22:02 localhost rsyslogd: action 'action 3' suspended (module 'builtin:omfile'), retry 0. There should be messages before this one giving the reason for suspension. [v8.32.0 try http://www.rsyslog.com/e/2007 ]
Aug 19 19:22:02 localhost rsyslogd: action 'action 3' resumed (module 'builtin:omfile') [v8.32.0 try http://www.rsyslog.com/e/2359 ]
Aug 19 19:22:02 localhost rsyslogd: action 'action 3' suspended (module 'builtin:omfile'), retry 0. There should be messages before this one giving the reason for suspension. [v8.32.0 try http://www.rsyslog.com/e/2007 ]
Aug 19 19:22:02 localhost rsyslogd: action 'action 3' resumed (module 'builtin:omfile') [v8.32.0 try http://www.rsyslog.com/e/2359 ]
Aug 19 19:22:02 localhost rsyslogd: action 'action 3' suspended (module 'builtin:omfile'), retry 0. There should be messages before this one giving the reason for suspension. [v8.32.0 try http://www.rsyslog.com/e/2007 ]
Aug 19 19:22:02 localhost rsyslogd: action 'action 3' resumed (module 'builtin:omfile') [v8.32.0 try http://www.rsyslog.com/e/2359 ]
Aug 19 19:22:02 localhost rsyslogd: action 'action 3' suspended (module 'builtin:omfile'), retry 0. There should be messages before this one giving the reason for suspension. [v8.32.0 try http://www.rsyslog.com/e/2007 ]
Aug 19 19:22:02 localhost rsyslogd: action 'action 3' resumed (module 'builtin:omfile') [v8.32.0 try http://www.rsyslog.com/e/2359 ]
Aug 19 19:22:02 localhost rsyslogd: action 'action 3' suspended (module 'builtin:omfile'), retry 0. There should be messages before this one giving the reason for suspension. [v8.32.0 try http://www.rsyslog.com/e/2007 ]
Aug 19 19:22:02 localhost rsyslogd: action 'action 3' resumed (module 'builtin:omfile') [v8.32.0 try http://www.rsyslog.com/e/2359 ]
Aug 19 19:22:02 localhost rsyslogd: action 'action 3' suspended (module 'builtin:omfile'), retry 0. There should be messages before this one giving the reason for suspension. [v8.32.0 try http://www.rsyslog.com/e/2007 ]
Aug 19 19:22:02 localhost rsyslogd: action 'action 3' resumed (module 'builtin:omfile') [v8.32.0 try http://www.rsyslog.com/e/2359 ]
Aug 19 19:22:02 localhost rsyslogd: action 'action 3' suspended (module 'builtin:omfile'), retry 0. There should be messages before this one giving the reason for suspension. [v8.32.0 try http://www.rsyslog.com/e/2007 ]
Aug 19 19:22:02 localhost rsyslogd: action 'action 3' suspended (module 'builtin:omfile'), next retry is Sun Aug 19 19:22:32 2018, retry nbr 0. There should be messages before this one giving the reason for suspension. [v8.32.0 try http://www.rsyslog.com/e/2007 ]
Looking at the link provided for the first error it says:
Search Results for: error 2359
rsyslog error 2359
Posted on June 13, 2018 by pwithopf
Status: action was resumed (used for reporting)
The link on the 2nd error, 2007, shows:
rsyslog error 2007
Posted on June 11, 2018 by rgerhards
What does it mean?
This is a generic error message that unfortunately can happen in a number of cases.
How to solve it?
A frequent case for this error message on Debian-based distributions (like raspbian) is that rsyslog.conf contains the instruction to write to the xconsole pipe, but this pipe is never read. If so, you can simply delete these lines to remove the error message. These lines are usually found at the end of rsyslog.conf.
For other error message, it probably is a good idea to check rsyslog’s issue tracker at github and file a new issue if you can’t find a related case.
I can't see in my /etc/rsyslog.conf file what they mean by "instruction to write to the xconsole pipe"
chris@localhost:/etc$ cat rsyslog.conf
# /etc/rsyslog.conf Configuration file for rsyslog.
#
# For more information see
# /usr/share/doc/rsyslog-doc/html/rsyslog_conf.html
#
# Default logging rules can be found in /etc/rsyslog.d/50-default.conf
#################
#### MODULES ####
#################
module(load="imuxsock") # provides support for local system logging
#module(load="immark") # provides --MARK-- message capability
# provides UDP syslog reception
#module(load="imudp")
#input(type="imudp" port="514")
# provides TCP syslog reception
#module(load="imtcp")
#input(type="imtcp" port="514")
# provides kernel logging support and enable non-kernel klog messages
module(load="imklog" permitnonkernelfacility="on")
###########################
#### GLOBAL DIRECTIVES ####
###########################
#
# Use traditional timestamp format.
# To enable high precision timestamps, comment out the following line.
#
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
# Filter duplicated messages
$RepeatedMsgReduction on
#
# Set the default permissions for all log files.
#
$FileOwner syslog
$FileGroup adm
$FileCreateMode 0640
$Umask 0022
$PrivDropToUser syslog
$PrivDropToGroup syslog
#
# Where to place spool and state files
#
$WorkDirectory /var/spool/rsyslog
#
# Include all config files in /etc/rsyslog.d/
#
$IncludeConfig /etc/rsyslog.d/*.conf
Version information:
apt-cache policy rsyslog
rsyslog:
Installed: 8.32.0-1ubuntu4
Candidate: 8.32.0-1ubuntu4
I have set logging to high.
I am not seeing any log messages.
I do see the empty ufw.log file.
No messages in dmesg
I'm running Ubuntu-10.04.04LTS in Hyper-V environments. I found that SSH, HTTP or any other service else stopped because the rsyslog daemon had died with the message unable to find the /dev/xconsole file.
I fixed it temporarily with the following.
FILE=/dev/xconsole
if [ -e $FILE ]; then
echo "$FILE exists Carry on!"
else
mknod -m 640 /dev/xconsole c 1 3
chown syslog:adm /dev/xconsole
echo "Created $FILE."
fi
The problem is that I can not get rsyslog daemon to process these 8 lines when I restart the daemon.
Also restarting the daemon removes the /dev/xconsole file and we are back to all service stopped. In addressing this problem I have inserted the if--fi lines after the start and restart conditions in the rsyslog script. The problem is I do not get an echo to stdio. Does someone have an idea on how to make the rsyslog report to stdio when it creates the /dev/xconsole device?
There are comments in the /etc/rsyslog.d/20-ufw.conf file that give you the option to keep UFW-events from being logged to the kernel and message logs, which i have done.
I would really like to get UFW-events out of the dmesg as well, but how to accomplish that?