2

Using release 2016.03.01 from Archlinux, with package rsyslogd 8.18.0, I started from the minimal configuration built from Very simple config : 

# cat rsyslog.conf
$ModLoad immark
$ModLoad imudp
$ModLoad imtcp
$ModLoad imuxsock
$ModLoad imklog

$template SyslFormat,"%timegenerated% [WJCG]-%HOSTNAME% %syslogtag%%msg:::space$

kern.debug /var/adm/syslog.dated/kern.log;SyslFormat
user.debug /var/adm/syslog.dated/user.log;SyslFormat
daemon.debug /var/adm/syslog.dated/daemon.log;SyslFormat
auth.crit;syslog.debug /var/adm/syslog.dated/syslog.log;SyslFormat
mail,lpr.debug /var/adm/syslog/misc.log;SyslFormat
kern.debug /var/adm/messages;SyslFormat
kern.debug /dev/console;SyslFormat
*.emerg *

local4.* /var/log/local4.log

Now, if I try (as a user or as root): 

# echo hello|logger -p local4.info

Nothing is logged, no file /var/log/local4.log is created.
However at the end of the systemd journal, I've got: 

# journalctl -xe|tail
Jun 10 18:32:17 mothership mobr[1681]: hello
Jun 10 18:38:09 mothership root[1696]: hello

Seems like systemd is messing with the regular log, but I cannot find how. Any clue?

Solved:
by creating the log file: # touch /var/log/local4.log
and activating option ForwardToSyslog=yes in /etc/systemd/journald.conf

Francois
  • 207
  • 2
  • 9
  • it used to be that syslog wanted the file to be present before it would write to it; try touching the local4.log first and re-test? – Jeff Schaller Jun 10 '16 at 16:54
  • yes! that was it. Many thanks Jeff, feel free to write an answer. – Francois Jun 13 '16 at 12:12
  • wait, actually it solved the problem only for 1 of my 3 archlinux systems (all 3 have the exact same rsyslog configuration). There is possibly some systemd configuration to be done too. – Francois Jun 13 '16 at 14:45

1 Answers1

1

I would welcome links for supporting documentation on this, as I cannot find it on rsyslog.com's site. It is apparent from OP's testing, though, that rsyslog (with the given configuration) will refuse to create new files; to enable logging to those files, create them first (e.g. touch /var/log/local4.log).

This has cropped up before in: How to tell rsyslog to create log file if not there? as that question asks about file deletion; file rotation via logrotate would be a similar case.

Community
  • 1
Jeff Schaller
  • 66,199
  • 35
  • 114
  • 250
  • there is this special section of the archlinux wiki about rsyslog: https://wiki.archlinux.org/index.php/rsyslog. – Francois Jun 13 '16 at 14:42
  • and this one about the interaction of systemd journal and rsyslog: https://wiki.archlinux.org/index.php/systemd#Journald_in_conjunction_with_syslog. – Francois Jun 13 '16 at 15:34