I am looking at /var/log/auth.log on a Debian Webserver, and the last thing it logged was:

Jul  2 21:09:01 h311 /USR/SBIN/CRON[25912]: (root) CMD (  [ -x /usr/lib/php5/maxlifetime ] && [ -d /var/lib/php5 ] && find /var/lib/php5/ -depth -mindepth 1 -maxdepth 1 -type f -ignore_readdir_race -cmin +$(/usr/lib/php5/maxlifetime) ! -execdir fuser -s {} 2>/dev/null \; -delete)
Jul  2 21:12:37 h311 systemd[1]: Reloading.

/var/log/syslog has is 0 bytes in size. Older logs are in their archives.

I have tried deleting it, restarting services. It got created again, 0 bytes in size, again.

I have tried to install things like syslog-ng on this server, and deleted them after some playing around. Some package I've installed could have tampered with the configuration, but I can't tell you exactly.

There is also more then one superuser on this server, so it might be something else.

What should I check and try to do in order to get logging working again?

  • Do you have any daemon running to handle syslog? sudo fuser /dev/log should list a process ID, which is the daemon.
    – wurtel
    Oct 24, 2014 at 11:51
  • @wurtel Output is: /dev/log: 1 205
    – cab00t
    Oct 24, 2014 at 12:22
  • Ah, I now see systemd in your log output. Systemd thinks it's much better to log everything in binary format, so you need tools to extract the logs from systemd so you can read them; apparently the configuration changed on July 2nd. Sorry, I can't help you with systemd (which I consider evil IMHO. See boycottsystemd.org , I won't engage in discussions about systemd.)
    – wurtel
    Oct 24, 2014 at 12:27
  • 1 = systemd 205 = systemd-journal
    – cab00t
    Oct 24, 2014 at 12:28
  • @wrutel I understand, thanks for the help. Could you maybe give me a hint on how to revert back to a Debian native style logging? Turn off systemd?
    – cab00t
    Oct 24, 2014 at 12:29

1 Answer 1


As indicated in the comments, your system is using systemd for service management. Systemd is a replacement for the traditional SysVinit. It also bundles in a lot of other things such as a syslog collector. In this case, to get access to your logs, you need to use the journalctl command.

$ journalctl

If you want to see only the sshd logs, you can pass a filter:

$ journalctl -n 1 _COMM=sshd
-- Logs begin at Wed 2014-10-22 19:29:29 EDT, end at Fri 2014-10-24 09:05:09 EDT. --
Oct 24 09:05:09 gadget sshd[5800]: pam_unix(sshd:session): session closed for user phemmer

You can see what the available filter fields are by changing the output format to verbose:

$ journalctl -n 1 -o verbose
Fri 2014-10-24 09:05:09.533633 EDT [s=30566909a26443ffb7185d318ccc4cd6;i=3d5d;b=19dd64e325fd4577a78af1a73f005b6c;m=1e82168a3c;t=5062ad4a511bc;x=1fae374af8a7dbc3]
    _CMDLINE=sshd: phemmer [priv]   
    MESSAGE=pam_unix(sshd:session): session closed for user phemmer

To answer your comment about disabling systemd. I would not advise it. Your distribution is moving towards systemd, and ripping out a core component of the system will likely make your life extremely difficult.
It would be possible to disable just the log journal, and use a traditional syslog daemon, without too much pain, but I would recommend learning to use the journal before deciding not to use it. Going against convention should not be done lightly.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.