4

I'm having troubles with CentOS release 6.4 (Final). I'm looking for log files in /var/log/ and I'm obviously missing two files:

  • /var/logs/messages
  • /var/log/secure

I was checking if rsyslog is running (service rsyslog status) and it's OK. My rsyslog config file is called /etc/rsyslog.conf, folder /etc/rsysconf.d/ is empty.

Can anyone shed some light on what's going on?

  • lsof | grep messages? – c4f4t0r May 12 '14 at 19:10
  • the result of lsof | grep messages is blank. No response. And I'm getting the same result for lsof | grep secure – Tom Hert May 12 '14 at 19:13
  • this discussion might be useful – user2720864 Jul 16 '14 at 21:20
2

check if have any rule for store in /var/log/messages or /var/log/secure in /etc/rsyslog.conf like

# Don't log private authentication messages!
*.info;mail.none;authpriv.none;cron.none  /var/log/messages

# The authpriv file has restricted access.
authpriv.*   /var/log/secure

if does not have , add this line and restart your rsyslog service.

/etc/init.d/rsyslog restart

or

service rsyslog restart
  • I have there following lines: # Log anything (except mail) of level info or higher. # Don't log private authentication messages! *.info;mail.none;authpriv.none;cron.none /var/log/messages# The authpriv file has restricted access. authpriv.* /var/log/secure – Tom Hert May 12 '14 at 20:09
0

the problem may that in RHEL7 (CentOS) and Fedora now use journald, which listens on /dev/log for incoming messages; rsyslog actually reads messages from the journal via its API by default but installed rsyslog needed. Try journalctl.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.