Using release 2016.03.01 from Archlinux, with package rsyslogd 8.18.0, I started from the minimal configuration built from Very simple config :

# cat rsyslog.conf
$ModLoad immark
$ModLoad imudp
$ModLoad imtcp
$ModLoad imuxsock
$ModLoad imklog

$template SyslFormat,"%timegenerated% [WJCG]-%HOSTNAME% %syslogtag%%msg:::space$

kern.debug /var/adm/syslog.dated/kern.log;SyslFormat
user.debug /var/adm/syslog.dated/user.log;SyslFormat
daemon.debug /var/adm/syslog.dated/daemon.log;SyslFormat
auth.crit;syslog.debug /var/adm/syslog.dated/syslog.log;SyslFormat
mail,lpr.debug /var/adm/syslog/misc.log;SyslFormat
kern.debug /var/adm/messages;SyslFormat
kern.debug /dev/console;SyslFormat
*.emerg *

local4.* /var/log/local4.log

Now, if I try (as a user or as root):

# echo hello|logger -p local4.info

Nothing is logged, no file /var/log/local4.log is created.
However at the end of the systemd journal, I've got:

# journalctl -xe|tail
Jun 10 18:32:17 mothership mobr[1681]: hello
Jun 10 18:38:09 mothership root[1696]: hello

Seems like systemd is messing with the regular log, but I cannot find how. Any clue?

by creating the log file: # touch /var/log/local4.log
and activating option ForwardToSyslog=yes in /etc/systemd/journald.conf

  • it used to be that syslog wanted the file to be present before it would write to it; try touching the local4.log first and re-test?
    – Jeff Schaller
    Jun 10 '16 at 16:54
  • yes! that was it. Many thanks Jeff, feel free to write an answer.
    – Francois
    Jun 13 '16 at 12:12
  • wait, actually it solved the problem only for 1 of my 3 archlinux systems (all 3 have the exact same rsyslog configuration). There is possibly some systemd configuration to be done too.
    – Francois
    Jun 13 '16 at 14:45

I would welcome links for supporting documentation on this, as I cannot find it on rsyslog.com's site. It is apparent from OP's testing, though, that rsyslog (with the given configuration) will refuse to create new files; to enable logging to those files, create them first (e.g. touch /var/log/local4.log).

This has cropped up before in: How to tell rsyslog to create log file if not there? as that question asks about file deletion; file rotation via logrotate would be a similar case.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.