Nothing going into syslog

[Yvonne Butler]

Hi

We have two new rx3600 servers which have just been built by consultants but for some reason no messages are going into syslog. I've restarted syslogd but still nothing.

Any ideas?

[Richard Hepworth]

Hi Yvonne,

Can you post the contents of /etc/syslog.conf?

thanks

Richard

[TTr]

> I've restarted syslogd but still nothing.

How long has the syslogd been running? It is possible that nothing was generated. Force a syslog message by running "logger test".
Check if syslog is actually running and check its startup file in /etc/rc.config.d/syslog.
Check if /etc/syslog.conf is modified and they set the servers to log somewhere else or not log at all. Check if the consultants installed syslog-ng.

[Yvonne Butler]

Hi

Yes sorry I should have mentioned that each time I've restarted syslogd I've run logger to put a message through but it doesn't enter into the syslog.log. As for the contents of syslog.conf, see below:

# @(#)B.11.31_LR
#
# syslogd configuration file.
#
# See syslogd(1M) for information about the format of this file.
#
mail.debug /var/adm/syslog/mail.log
local5.info /var/adm/syslog/local5ftp.log
daemon.info /var/adm/syslog/daemon.log
auth.info /var/adm/syslog/auth.log
*.info;mail.none;local5.none;daemon.none;auth.info /var/adm/syslog/syslog.l
og
*.alert /dev/console
*.alert root
*.emerg *
user.alert @uklnet002

[James R. Ferguson · Accepted solution]

Hi Yvonne:

The '/etc/syslog.conf' file requires TAB characters as field seperators as described in the manpages for 'syslogd(1M)'.

Make sure you have TAB and not space characters. You can verify with:

# cat -et /etc/syslog.conf

Regards!

...JRF...

[TTr]

The last line in the syslog.conf is an add-onn. I suspect it has spaces in it.

[Yvonne Butler]

Hi

You were right, that last line did have spaces and I replaced them with a tab, restarted syslogd (by running kill -HUP on the process), then ran a logger command but still nothing in the syslog.log.

rgds

[Yvonne Butler]

Fixed it!

I copied over a syslog.conf from the old server and suspect there were more spaces in the file on other lines as the old syslog.conf works fine.

Thanks everyone.