rsyslog seems to have vanished from my system
I'm debugging an issue where I think my server is spamming other servers because it is infected but all my logs stop in august last year, and rsyslog is missing from the system /etc/rsyslog.d still exists and clearly it was writing logs once but there are no new logs being generated for /var/log/mail.log or /var/log/messages
but running
rsyslog
results in command not found, should I run:
apt-get install rsyslog
and then
service rsyslog start
and has any one seen anything like this before?
ubuntu logs email rsyslog
asked Jul 21 '15 at 10:10
arcaninearcanine
1112
bumped to the homepage by Community♦ 10 mins ago
This question has answers that may be good or bad; the system has marked it active so that they can be reviewed.
|
show 1 more comment
I'm debugging an issue where I think my server is spamming other servers because it is infected but all my logs stop in august last year, and rsyslog is missing from the system /etc/rsyslog.d still exists and clearly it was writing logs once but there are no new logs being generated for /var/log/mail.log or /var/log/messages
but running
rsyslog
results in command not found, should I run:
apt-get install rsyslog
and then
service rsyslog start
and has any one seen anything like this before?
ubuntu logs email rsyslog
asked Jul 21 '15 at 10:10
arcaninearcanine
1112
bumped to the homepage by Community♦ 10 mins ago
This question has answers that may be good or bad; the system has marked it active so that they can be reviewed.
tryrsyslogd.
– Manuel Faux
Jul 21 '15 at 10:13
it says command not found and unrecognized service
– arcanine
Jul 21 '15 at 10:23
which rsyslogd?
– neuron
Jul 21 '15 at 10:24
no output is given
– arcanine
Jul 21 '15 at 10:27
What is the output ofls -l /usr/sbin/rsyslogd?
– mjturner
Jul 21 '15 at 10:54
|
show 1 more comment
I'm debugging an issue where I think my server is spamming other servers because it is infected but all my logs stop in august last year, and rsyslog is missing from the system /etc/rsyslog.d still exists and clearly it was writing logs once but there are no new logs being generated for /var/log/mail.log or /var/log/messages
but running
rsyslog
results in command not found, should I run:
apt-get install rsyslog
and then
service rsyslog start
and has any one seen anything like this before?
ubuntu logs email rsyslog
asked Jul 21 '15 at 10:10
arcaninearcanine
1112
I'm debugging an issue where I think my server is spamming other servers because it is infected but all my logs stop in august last year, and rsyslog is missing from the system /etc/rsyslog.d still exists and clearly it was writing logs once but there are no new logs being generated for /var/log/mail.log or /var/log/messages
but running
rsyslog
results in command not found, should I run:
apt-get install rsyslog
and then
service rsyslog start
and has any one seen anything like this before?
ubuntu logs email rsyslog
ubuntu logs email rsyslog
asked Jul 21 '15 at 10:10
arcaninearcanine
1112
asked Jul 21 '15 at 10:10
arcaninearcanine
1112
asked Jul 21 '15 at 10:10
arcaninearcanine
1112
asked Jul 21 '15 at 10:10
arcaninearcanine
1112
asked Jul 21 '15 at 10:10
arcaninearcanine
1112
1112
bumped to the homepage by Community♦ 10 mins ago
This question has answers that may be good or bad; the system has marked it active so that they can be reviewed.
bumped to the homepage by Community♦ 10 mins ago
This question has answers that may be good or bad; the system has marked it active so that they can be reviewed.
tryrsyslogd.
– Manuel Faux
Jul 21 '15 at 10:13
it says command not found and unrecognized service
– arcanine
Jul 21 '15 at 10:23
which rsyslogd?
– neuron
Jul 21 '15 at 10:24
no output is given
– arcanine
Jul 21 '15 at 10:27
What is the output ofls -l /usr/sbin/rsyslogd?
– mjturner
Jul 21 '15 at 10:54
|
show 1 more comment
tryrsyslogd.
– Manuel Faux
Jul 21 '15 at 10:13
it says command not found and unrecognized service
– arcanine
Jul 21 '15 at 10:23
which rsyslogd?
– neuron
Jul 21 '15 at 10:24
no output is given
– arcanine
Jul 21 '15 at 10:27
What is the output ofls -l /usr/sbin/rsyslogd?
– mjturner
Jul 21 '15 at 10:54
try
rsyslogd.– Manuel Faux
Jul 21 '15 at 10:13
try
rsyslogd.– Manuel Faux
Jul 21 '15 at 10:13
it says command not found and unrecognized service
– arcanine
Jul 21 '15 at 10:23
it says command not found and unrecognized service
– arcanine
Jul 21 '15 at 10:23
which rsyslogd ?– neuron
Jul 21 '15 at 10:24
which rsyslogd ?– neuron
Jul 21 '15 at 10:24
no output is given
– arcanine
Jul 21 '15 at 10:27
no output is given
– arcanine
Jul 21 '15 at 10:27
What is the output of
ls -l /usr/sbin/rsyslogd?– mjturner
Jul 21 '15 at 10:54
What is the output of
ls -l /usr/sbin/rsyslogd?– mjturner
Jul 21 '15 at 10:54
|
show 1 more comment
3 Answers
3
active
oldest
votes
Open the terminal and execute the command
# sudo add-apt-repository ppa:adiscon/v8-stable
Now install rsyslog
# sudo apt-get install rsyslog
to check rsyslog version,
# rsyslogd -v
rsyslogd 7.4.4, compiled with:
FEATURE_REGEXP: Yes
FEATURE_LARGEFILE: No
GSSAPI Kerberos 5 support: Yes
FEATURE_DEBUG (debug build, slow code): No
32bit Atomic operations supported: Yes
64bit Atomic operations supported: Yes
Runtime Instrumentation (slow code): No
uuid support: Yes
Also check whether your rsyslog running
edited Apr 13 '17 at 12:36
Community♦
1
answered Jul 21 '15 at 13:34
lakshmikandanlakshmikandan
1415
I wouldn't suggest installingrsyslogfrom a PPA - that's unnecessary. If the original poster doesn't have it installed, they can reinstall from the official Ubuntu repositories.
– mjturner
Jul 21 '15 at 15:36
add a comment |
I've re-installed it using
apt-get install rsyslog
and logs seem to be filling up again, odd that it seems to have gone missing in the first place, it's clearly been on the system before
answered Jul 21 '15 at 17:11
arcaninearcanine
1112
Lots of malicious attacks involve disabling logging or redirecting logs to/dev/null. Its an early step after compromising a system, in order to avoid an audible trail. You might want to be suspicious of the system on the whole IMHO.
– datUser
Jul 21 '15 at 17:51
add a comment |
Could be that You are running systemd.
Look in /var/log/README
You are running a systemd-based OS where traditional syslog has been
replaced with the Journal.
answered May 18 '18 at 18:35
Kjeld FlarupKjeld Flarup
111113
add a comment |
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "106"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f217335%2frsyslog-seems-to-have-vanished-from-my-system%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
3 Answers
3
active
oldest
votes
3 Answers
3
active
oldest
votes
active
oldest
votes
active
oldest
votes
Open the terminal and execute the command
# sudo add-apt-repository ppa:adiscon/v8-stable
Now install rsyslog
# sudo apt-get install rsyslog
to check rsyslog version,
# rsyslogd -v
rsyslogd 7.4.4, compiled with:
FEATURE_REGEXP: Yes
FEATURE_LARGEFILE: No
GSSAPI Kerberos 5 support: Yes
FEATURE_DEBUG (debug build, slow code): No
32bit Atomic operations supported: Yes
64bit Atomic operations supported: Yes
Runtime Instrumentation (slow code): No
uuid support: Yes
Also check whether your rsyslog running
edited Apr 13 '17 at 12:36
Community♦
1
answered Jul 21 '15 at 13:34
lakshmikandanlakshmikandan
1415
I wouldn't suggest installingrsyslogfrom a PPA - that's unnecessary. If the original poster doesn't have it installed, they can reinstall from the official Ubuntu repositories.
– mjturner
Jul 21 '15 at 15:36
add a comment |
Open the terminal and execute the command
# sudo add-apt-repository ppa:adiscon/v8-stable
Now install rsyslog
# sudo apt-get install rsyslog
to check rsyslog version,
# rsyslogd -v
rsyslogd 7.4.4, compiled with:
FEATURE_REGEXP: Yes
FEATURE_LARGEFILE: No
GSSAPI Kerberos 5 support: Yes
FEATURE_DEBUG (debug build, slow code): No
32bit Atomic operations supported: Yes
64bit Atomic operations supported: Yes
Runtime Instrumentation (slow code): No
uuid support: Yes
Also check whether your rsyslog running
edited Apr 13 '17 at 12:36
Community♦
1
answered Jul 21 '15 at 13:34
lakshmikandanlakshmikandan
1415
I wouldn't suggest installingrsyslogfrom a PPA - that's unnecessary. If the original poster doesn't have it installed, they can reinstall from the official Ubuntu repositories.
– mjturner
Jul 21 '15 at 15:36
add a comment |
Open the terminal and execute the command
# sudo add-apt-repository ppa:adiscon/v8-stable
Now install rsyslog
# sudo apt-get install rsyslog
to check rsyslog version,
# rsyslogd -v
rsyslogd 7.4.4, compiled with:
FEATURE_REGEXP: Yes
FEATURE_LARGEFILE: No
GSSAPI Kerberos 5 support: Yes
FEATURE_DEBUG (debug build, slow code): No
32bit Atomic operations supported: Yes
64bit Atomic operations supported: Yes
Runtime Instrumentation (slow code): No
uuid support: Yes
Also check whether your rsyslog running
edited Apr 13 '17 at 12:36
Community♦
1
answered Jul 21 '15 at 13:34
lakshmikandanlakshmikandan
1415
Open the terminal and execute the command
# sudo add-apt-repository ppa:adiscon/v8-stable
Now install rsyslog
# sudo apt-get install rsyslog
to check rsyslog version,
# rsyslogd -v
rsyslogd 7.4.4, compiled with:
FEATURE_REGEXP: Yes
FEATURE_LARGEFILE: No
GSSAPI Kerberos 5 support: Yes
FEATURE_DEBUG (debug build, slow code): No
32bit Atomic operations supported: Yes
64bit Atomic operations supported: Yes
Runtime Instrumentation (slow code): No
uuid support: Yes
Also check whether your rsyslog running
edited Apr 13 '17 at 12:36
Community♦
1
answered Jul 21 '15 at 13:34
lakshmikandanlakshmikandan
1415
edited Apr 13 '17 at 12:36
Community♦
1
edited Apr 13 '17 at 12:36
Community♦
1
edited Apr 13 '17 at 12:36
Community♦
1
1
answered Jul 21 '15 at 13:34
lakshmikandanlakshmikandan
1415
answered Jul 21 '15 at 13:34
lakshmikandanlakshmikandan
1415
answered Jul 21 '15 at 13:34
lakshmikandanlakshmikandan
1415
1415
I wouldn't suggest installingrsyslogfrom a PPA - that's unnecessary. If the original poster doesn't have it installed, they can reinstall from the official Ubuntu repositories.
– mjturner
Jul 21 '15 at 15:36
add a comment |
I wouldn't suggest installingrsyslogfrom a PPA - that's unnecessary. If the original poster doesn't have it installed, they can reinstall from the official Ubuntu repositories.
– mjturner
Jul 21 '15 at 15:36
I wouldn't suggest installing
rsyslog from a PPA - that's unnecessary. If the original poster doesn't have it installed, they can reinstall from the official Ubuntu repositories.– mjturner
Jul 21 '15 at 15:36
I wouldn't suggest installing
rsyslog from a PPA - that's unnecessary. If the original poster doesn't have it installed, they can reinstall from the official Ubuntu repositories.– mjturner
Jul 21 '15 at 15:36
add a comment |
I've re-installed it using
apt-get install rsyslog
and logs seem to be filling up again, odd that it seems to have gone missing in the first place, it's clearly been on the system before
answered Jul 21 '15 at 17:11
arcaninearcanine
1112
Lots of malicious attacks involve disabling logging or redirecting logs to/dev/null. Its an early step after compromising a system, in order to avoid an audible trail. You might want to be suspicious of the system on the whole IMHO.
– datUser
Jul 21 '15 at 17:51
add a comment |
I've re-installed it using
apt-get install rsyslog
and logs seem to be filling up again, odd that it seems to have gone missing in the first place, it's clearly been on the system before
answered Jul 21 '15 at 17:11
arcaninearcanine
1112
Lots of malicious attacks involve disabling logging or redirecting logs to/dev/null. Its an early step after compromising a system, in order to avoid an audible trail. You might want to be suspicious of the system on the whole IMHO.
– datUser
Jul 21 '15 at 17:51
add a comment |
I've re-installed it using
apt-get install rsyslog
and logs seem to be filling up again, odd that it seems to have gone missing in the first place, it's clearly been on the system before
answered Jul 21 '15 at 17:11
arcaninearcanine
1112
I've re-installed it using
apt-get install rsyslog
and logs seem to be filling up again, odd that it seems to have gone missing in the first place, it's clearly been on the system before
answered Jul 21 '15 at 17:11
arcaninearcanine
1112
answered Jul 21 '15 at 17:11
arcaninearcanine
1112
answered Jul 21 '15 at 17:11
arcaninearcanine
1112
answered Jul 21 '15 at 17:11
arcaninearcanine
1112
1112
Lots of malicious attacks involve disabling logging or redirecting logs to/dev/null. Its an early step after compromising a system, in order to avoid an audible trail. You might want to be suspicious of the system on the whole IMHO.
– datUser
Jul 21 '15 at 17:51
add a comment |
Lots of malicious attacks involve disabling logging or redirecting logs to/dev/null. Its an early step after compromising a system, in order to avoid an audible trail. You might want to be suspicious of the system on the whole IMHO.
– datUser
Jul 21 '15 at 17:51
Lots of malicious attacks involve disabling logging or redirecting logs to
/dev/null. Its an early step after compromising a system, in order to avoid an audible trail. You might want to be suspicious of the system on the whole IMHO.– datUser
Jul 21 '15 at 17:51
Lots of malicious attacks involve disabling logging or redirecting logs to
/dev/null. Its an early step after compromising a system, in order to avoid an audible trail. You might want to be suspicious of the system on the whole IMHO.– datUser
Jul 21 '15 at 17:51
add a comment |
Could be that You are running systemd.
Look in /var/log/README
You are running a systemd-based OS where traditional syslog has been
replaced with the Journal.
answered May 18 '18 at 18:35
Kjeld FlarupKjeld Flarup
111113
add a comment |
Could be that You are running systemd.
Look in /var/log/README
You are running a systemd-based OS where traditional syslog has been
replaced with the Journal.
answered May 18 '18 at 18:35
Kjeld FlarupKjeld Flarup
111113
add a comment |
Could be that You are running systemd.
Look in /var/log/README
You are running a systemd-based OS where traditional syslog has been
replaced with the Journal.
answered May 18 '18 at 18:35
Kjeld FlarupKjeld Flarup
111113
Could be that You are running systemd.
Look in /var/log/README
You are running a systemd-based OS where traditional syslog has been
replaced with the Journal.
answered May 18 '18 at 18:35
Kjeld FlarupKjeld Flarup
111113
answered May 18 '18 at 18:35
Kjeld FlarupKjeld Flarup
111113
answered May 18 '18 at 18:35
Kjeld FlarupKjeld Flarup
111113
answered May 18 '18 at 18:35
Kjeld FlarupKjeld Flarup
111113
111113
add a comment |
add a comment |
Thanks for contributing an answer to Unix & Linux Stack Exchange!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f217335%2frsyslog-seems-to-have-vanished-from-my-system%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
try
rsyslogd.– Manuel Faux
Jul 21 '15 at 10:13
it says command not found and unrecognized service
– arcanine
Jul 21 '15 at 10:23
which rsyslogd?– neuron
Jul 21 '15 at 10:24
no output is given
– arcanine
Jul 21 '15 at 10:27
What is the output of
ls -l /usr/sbin/rsyslogd?– mjturner
Jul 21 '15 at 10:54