Page MenuHomeVyOS Platform

syslog messages split accross multiple files
Closed, ResolvedPublicBUG

Description

After the change to rsyslog I now see two logging files messages and vyos-rsyslog. Bot logfiles are in use and contain different logmessages, is this expected?

Why not simply still use the messages file even when running rsyslogd?

cpo@AC1:/var/log$ ls -al messages* vyos-rsyslog*
-rw-r----- 1 root adm 23778702 Sep  7 09:27 messages
-rw-r----- 1 root adm   189298 Sep  7 09:27 vyos-rsyslog
-rw-r----- 1 root adm   262166 Sep  5 23:20 vyos-rsyslog.1
-rw-r----- 1 root adm   262289 Sep  3 18:10 vyos-rsyslog.2
-rw-r----- 1 root adm   262155 Sep  1 16:00 vyos-rsyslog.3
-rw-r----- 1 root adm   262163 Aug 29 23:45 vyos-rsyslog.4
-rw-r----- 1 root adm   262191 Aug 27 18:05 vyos-rsyslog.5
syslog {
    global {
        facility all {
            level notice
        }
        facility protocols {
            level debug
        }
    }
    host 172.16.100.1 {
        facility all {
            level warning
        }
    }
}

Details

Difficulty level
Unknown (require assessment)
Version
VyOS 1.2.0-rolling+201808212334
Why the issue appeared?
Will be filled on close

Event Timeline

c-po triaged this task as Normal priority.
c-po created this task.

Yes and no. The /var/log/messages config is generated somewhere, I was asking about that while implementing. The problem was as far as i recall, that your settings in the cli aren't applied when you reboot. If you change something in the syslog config it will be accepted and then restart rsyslog and all is well. Then I got distracted with the wireguard implementation:).
I have a look today, thanks for letting me know.

Ok, so the issue with using messages is that it is defined in rsyslog.conf, which overrules then rsyslog.d/*.conf. I'm gonna get that fixed, back then I wasn't sure how to handle it and when I asked, I never got an answer. I'm going to implement your proposal and /var/log/messages will the global default (tail uses it via monitor too). The file vyos-rsyslog will be removed.

Thanks! Sounds like a proper fix to me.