0

Was trying to enable log for chroot users May have done sth. wrong ,find ls -l in /var/log most log files size stay 0. Try to fix it followed this answer

# systemctl restart systemd-journald.socket
# systemctl start rsyslogd
Failed to start rsyslogd.service: Unit rsyslogd.service not found.

and this answer

# logger -s "hellow"
logger: socket /dev/log: No such file or directory
# sudo rsyslogd -N6 | head -10
sudo: unable to resolve host iZ26v45oj3yjtmZ
rsyslogd: version 8.16.0, config validation run (level 6), master config /etc/rsyslog.conf
rsyslogd: command 'KLogPermitNonKernelFacility' is currently not permitted - did you already set it via a RainerScript command (v6+ config)? [v8.16.0 try http://www.rsyslog.com/e/2222 ]

# ls /dev/log
ls: cannot access '/dev/log': No such file or directory

And checked syslogd is running

#lsof -f -p 5379
syslogd 5379 root   16w   REG              253,1        0    1844521 /var/log/news/news.err
syslogd 5379 root   17w   REG              253,1        0    1844536 /var/log/news/news.notice
syslogd 5379 root   18w   REG              253,1     3282    1580873 /var/log/debug.1 (deleted)
syslogd 5379 root   19w   REG              253,1   110492    1580898 /var/log/messages.1 (deleted)
syslogd 5379 root   20u  FIFO                0,6      0t0        423 /dev/xconsole
syslogd 5379 root   21u  unix 0xffff880138be9400      0t0     212524 /dev/log type=DGRAM

The /etc/rsyslog.conf file

#################
#### MODULES ####
#################

module(load="imuxsock") # provides support for local system logging
module(load="imklog")   # provides kernel logging support
#module(load="immark")  # provides --MARK-- message capability

# provides UDP syslog reception
#module(load="imudp")
#input(type="imudp" port="514")

# provides TCP syslog reception
#module(load="imtcp")
#input(type="imtcp" port="514")
# Enable non-kernel facility klog messages
$KLogPermitNonKernelFacility on

###########################
#### GLOBAL DIRECTIVES ####
###########################

#
# Use traditional timestamp format.
# To enable high precision timestamps, comment out the following line.
#
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

# Filter duplicated messages
$RepeatedMsgReduction on
#
# Set the default permissions for all log files.
#
$FileOwner syslog
$FileGroup adm
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022
$PrivDropToUser syslog
$PrivDropToGroup syslog

#
# Where to place spool and state files
#
$WorkDirectory /var/spool/rsyslog

#
# Include all config files in /etc/rsyslog.d/
#
$IncludeConfig /etc/rsyslog.d/*.conf

The /etc/syslog.conf file

#  /etc/syslog.conf     Configuration file for inetutils-syslogd.
#
#                       For more information see syslog.conf(5) manpage.

#
# First some standard logfiles.  Log by facility.
#

auth,authpriv.*                 /var/log/auth.log
*.*;auth,authpriv.none          -/var/log/syslog
#cron.*                         /var/log/cron.log
daemon.*                        -/var/log/daemon.log
kern.*                          -/var/log/kern.log
lpr.*                           -/var/log/lpr.log
mail.*                          -/var/log/mail.log
user.*                          -/var/log/user.log
uucp.*                          /var/log/uucp.log

#
# Logging for the mail system.  Split it up so that
# it is easy to write scripts to parse these files.
#
mail.info                       -/var/log/mail.info
mail.warn                       -/var/log/mail.warn
mail.err                        /var/log/mail.err

# Logging for INN news system
#
news.crit                       /var/log/news/news.crit
news.err                        /var/log/news/news.err
news.notice                     -/var/log/news/news.notice

#
# Some `catch-all' logfiles.
#
*.=debug;\
        auth,authpriv.none;\
        news.none;mail.none     -/var/log/debug
*.=info;*.=notice;*.=warn;\
        auth,authpriv.none;\
        cron,daemon.none;\
        mail,news.none          -/var/log/messages

#
# Emergencies are sent to everybody logged in.
#
*.emerg                         *

#
# I like to have messages displayed on the console, but only on a virtual
# console I usually leave idle.
#
#daemon,mail.*;\
#       news.=crit;news.=err;news.=notice;\
#       *.=debug;*.=info;\
#       *.=notice;*.=warn       /dev/tty8

# The named pipe /dev/xconsole is for the `xconsole' utility.  To use it,
# you must invoke `xconsole' with the `-file' option:
#
#    $ xconsole -file /dev/xconsole [...]
#
# NOTE: adjust the list below, or you'll go crazy if you have a reasonably
#      busy site..
#
daemon.*;mail.*;\
        news.crit;news.err;news.notice;\
        *.=debug;*.=info;\
        *.=notice;*.=warn       |/dev/xconsole

Problems here are: 1.

Failed to start rsyslogd.service

2.

ls: cannot access '/dev/log': No such file or directory

  1. ls -l /var/log most log file's size is 0
  • stop rsyslog service and run sudo rsyslogd -dn. See what does it say ? Also, have you made any file in /etc/rsyslog.d ? – Luv33preet Jul 28 '17 at 7:45
  • the output of sudo rsyslogd -dn is too much ,I put it on the main post.# ls /etc/rsyslog.d shows 20-ufw.conf 50-default.conf – Shihe Zhang Jul 28 '17 at 7:57
  • no dont post the output, it will give every single line. Just see what they say here. If you find anything helpful, post that thing. Or I would suggest you to open an issue in rsyslog github repo, github.com/rsyslog/rsyslog/issues/new – Luv33preet Jul 28 '17 at 8:06
  • Thank you @Luv33preet I remove the output,how ever the output is too long to read.Which part or keyword should be care? – Shihe Zhang Jul 28 '17 at 8:34
0

You cannot log inside a chroot because you need a /dev/log relative to the root of your chroot. (this is a known "feature").

Back in rsyslog, you add the a similar configuration to this one:

/etc/rsyslogd.conf
$AddUnixListenSocket /chroots/user1/dev/log

And restart rsyslog (outside the chroot)

See How to log internal-sftp chroot jailed users

  • ls /etc/rsyslogd.conf ls: cannot access '/etc/rsyslogd.conf': No such file or directory So I changed rsyslog.conf and restart rsyslog,but logger -s "Hello w" still complains logger: socket /dev/log: No such file or directory – Shihe Zhang Jul 28 '17 at 8:27
  • Ubuntu 16.04 64bit.How to recover it?Guess the /chroot/dev/log was wrong made but romove the /dev/log by mistake. – Shihe Zhang Jul 28 '17 at 9:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.