3

I am looking at /var/log/auth.log on a Debian Webserver, and the last thing it logged was:

Jul  2 21:09:01 h311 /USR/SBIN/CRON[25912]: (root) CMD (  [ -x /usr/lib/php5/maxlifetime ] && [ -d /var/lib/php5 ] && find /var/lib/php5/ -depth -mindepth 1 -maxdepth 1 -type f -ignore_readdir_race -cmin +$(/usr/lib/php5/maxlifetime) ! -execdir fuser -s {} 2>/dev/null \; -delete)
Jul  2 21:12:37 h311 systemd[1]: Reloading.

/var/log/syslog has is 0 bytes in size. Older logs are in their archives.

I have tried deleting it, restarting services. It got created again, 0 bytes in size, again.

I have tried to install things like syslog-ng on this server, and deleted them after some playing around. Some package I've installed could have tampered with the configuration, but I can't tell you exactly.

There is also more then one superuser on this server, so it might be something else.

What should I check and try to do in order to get logging working again?

  • Do you have any daemon running to handle syslog? sudo fuser /dev/log should list a process ID, which is the daemon. – wurtel Oct 24 '14 at 11:51
  • @wurtel Output is: /dev/log: 1 205 – cab00t Oct 24 '14 at 12:22
  • Ah, I now see systemd in your log output. Systemd thinks it's much better to log everything in binary format, so you need tools to extract the logs from systemd so you can read them; apparently the configuration changed on July 2nd. Sorry, I can't help you with systemd (which I consider evil IMHO. See boycottsystemd.org , I won't engage in discussions about systemd.) – wurtel Oct 24 '14 at 12:27
  • 1 = systemd 205 = systemd-journal – cab00t Oct 24 '14 at 12:28
  • @wrutel I understand, thanks for the help. Could you maybe give me a hint on how to revert back to a Debian native style logging? Turn off systemd? – cab00t Oct 24 '14 at 12:29
2

As indicated in the comments, your system is using systemd for service management. Systemd is a replacement for the traditional SysVinit. It also bundles in a lot of other things such as a syslog collector. In this case, to get access to your logs, you need to use the journalctl command.

$ journalctl

If you want to see only the sshd logs, you can pass a filter:

$ journalctl -n 1 _COMM=sshd
-- Logs begin at Wed 2014-10-22 19:29:29 EDT, end at Fri 2014-10-24 09:05:09 EDT. --
Oct 24 09:05:09 gadget sshd[5800]: pam_unix(sshd:session): session closed for user phemmer

You can see what the available filter fields are by changing the output format to verbose:

$ journalctl -n 1 -o verbose
Fri 2014-10-24 09:05:09.533633 EDT [s=30566909a26443ffb7185d318ccc4cd6;i=3d5d;b=19dd64e325fd4577a78af1a73f005b6c;m=1e82168a3c;t=5062ad4a511bc;x=1fae374af8a7dbc3]
    PRIORITY=6
    _UID=0
    _GID=0
    _BOOT_ID=19dd64e325fd4577a78af1a73f005b6c
    _MACHINE_ID=5288dcb47f9fed3ab946f54754305a4f
    _HOSTNAME=gadget
    _CAP_EFFECTIVE=1fffffffff
    _TRANSPORT=syslog
    SYSLOG_FACILITY=10
    SYSLOG_IDENTIFIER=sshd
    _COMM=sshd
    _EXE=/usr/sbin/sshd
    _SYSTEMD_OWNER_UID=1000
    _SYSTEMD_SLICE=user-1000.slice
    _PID=5800
    _CMDLINE=sshd: phemmer [priv]   
    _SYSTEMD_CGROUP=/user.slice/user-1000.slice/session-3.scope
    _SYSTEMD_SESSION=3
    _SYSTEMD_UNIT=session-3.scope
    MESSAGE=pam_unix(sshd:session): session closed for user phemmer
    _SOURCE_REALTIME_TIMESTAMP=1414155909533633

To answer your comment about disabling systemd. I would not advise it. Your distribution is moving towards systemd, and ripping out a core component of the system will likely make your life extremely difficult.
It would be possible to disable just the log journal, and use a traditional syslog daemon, without too much pain, but I would recommend learning to use the journal before deciding not to use it. Going against convention should not be done lightly.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.