I'm debugging an issue where I think my server is spamming other servers because it is infected but all my logs stop in august last year, and rsyslog is missing from the system /etc/rsyslog.d still exists and clearly it was writing logs once but there are no new logs being generated for /var/log/mail.log or /var/log/messages

but running


results in command not found, should I run:

apt-get install rsyslog 

and then

service rsyslog start

and has any one seen anything like this before?

  • try rsyslogd. – Manuel Faux Jul 21 '15 at 10:13
  • it says command not found and unrecognized service – arcanine Jul 21 '15 at 10:23
  • which rsyslogd ? – neuron Jul 21 '15 at 10:24
  • no output is given – arcanine Jul 21 '15 at 10:27
  • What is the output of ls -l /usr/sbin/rsyslogd? – mjturner Jul 21 '15 at 10:54

I've re-installed it using

apt-get install rsyslog 

and logs seem to be filling up again, odd that it seems to have gone missing in the first place, it's clearly been on the system before

  • Lots of malicious attacks involve disabling logging or redirecting logs to /dev/null. Its an early step after compromising a system, in order to avoid an audible trail. You might want to be suspicious of the system on the whole IMHO. – 111--- Jul 21 '15 at 17:51

Open the terminal and execute the command

# sudo add-apt-repository ppa:adiscon/v8-stable 

Now install rsyslog

# sudo apt-get install rsyslog

to check rsyslog version,

# rsyslogd -v
rsyslogd 7.4.4, compiled with:
    FEATURE_REGEXP:             Yes
    FEATURE_LARGEFILE:          No
    GSSAPI Kerberos 5 support:      Yes
    FEATURE_DEBUG (debug build, slow code): No
    32bit Atomic operations supported:  Yes
    64bit Atomic operations supported:  Yes
    Runtime Instrumentation (slow code):    No
    uuid support:               Yes

Also check whether your rsyslog running

  • I wouldn't suggest installing rsyslog from a PPA - that's unnecessary. If the original poster doesn't have it installed, they can reinstall from the official Ubuntu repositories. – mjturner Jul 21 '15 at 15:36

Could be that You are running systemd.

Look in /var/log/README

You are running a systemd-based OS where traditional syslog has been
replaced with the Journal.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.