/var/log files empty - journal working

General support questions
Post Reply
6iXnFoG8a34C
Posts: 3
Joined: 2018/06/14 19:58:08

/var/log files empty - journal working

Post by 6iXnFoG8a34C » 2018/06/14 20:03:27

Hello,

I've found similar threads but none fixed my issues.

/var/log/messages, maillog, cron are empty on my Centos 7 server.

I've checked this against another Centos 7 server and /etc/rsyslog.conf and /etc/systemd/journald.conf match on both the "logging to /var/log" and "not logging to /var/log" servers.

Can anyone suggest what else might be wrong. Other config files to compare? I'm more used to Centos 6/7 - is there any place else these settings may be hidden that I've missed?

Thanks!

hunter86_bg
Posts: 2019
Joined: 2015/02/17 15:14:33
Location: Bulgaria
Contact:

Re: /var/log files empty - journal working

Post by hunter86_bg » 2018/06/15 04:02:55

Check the rsyslog.service . If the daemon is not working, you won't have any logs captured.

6iXnFoG8a34C
Posts: 3
Joined: 2018/06/14 19:58:08

Re: /var/log files empty - journal working

Post by 6iXnFoG8a34C » 2018/06/15 04:28:07

Thanks for the reply.

rsyslog appears to be running:

[root@ log]# ps axuw | grep rsys
root 25746 0.0 0.2 706968 5460 ? Ssl 00:26 0:00 /usr/sbin/rsyslogd -n

I also restarted it just in case it was hung somehow. Still no logs.

pjsr2
Posts: 614
Joined: 2014/03/27 20:11:07

Re: /var/log files empty - journal working

Post by pjsr2 » 2018/06/16 14:01:53

I have seen that log messages no longer where passed by systemd to the rsyslog when the imjournal state file /var/lib/rsyslog/imjournal.state somehow got corrupted. The solution that worked for me was to remove or rename the existing state file and after that restart rsyslog:

Code: Select all

sudo mv /var/lib/rsyslog/imjournal.state  /var/lib/rsyslog/imjournal.state.old
sudo systemctl restart rsyslog

6iXnFoG8a34C
Posts: 3
Joined: 2018/06/14 19:58:08

Re: /var/log files empty - journal working

Post by 6iXnFoG8a34C » 2018/06/18 16:04:54

removing /var/lib/rsyslog/imjournal.state and restart seemed to do it! Thanks.

Post Reply