syslog is not running/appearing to work properly

[Guest]

I run logwatcher which is what led me to uncover this problem.

For the past couple days, my logwatcher e-mail has gotten smaller, and smaller. When I went to check out syslog, I was presented with this present surprise.

andrew@server:~/Downloads$ date
Fri Nov 16 13:11:37 EST 2012
andrew@server:~/Downloads$ cat /var/log/syslog
andrew@server:~/Downloads$ ls -l /var/log/syslog*
-rw-r----- 1 syslog adm     0 Nov 16 07:37 /var/log/syslog
-rw-r----- 1 syslog adm    20 Nov 15 07:36 /var/log/syslog.1.gz
-rw-r----- 1 syslog adm    20 Nov 14 07:43 /var/log/syslog.2.gz
-rw-r----- 1 syslog adm    20 Nov 13 07:39 /var/log/syslog.3.gz
-rw-r----- 1 syslog adm    20 Nov 12 07:40 /var/log/syslog.4.gz
-rw-r----- 1 syslog adm 84817 Nov 12 07:39 /var/log/syslog.5.gz
-rw-r----- 1 syslog adm 94447 Nov 11 07:53 /var/log/syslog.6.gz
-rw-r----- 1 syslog adm 15198 Nov 10 07:57 /var/log/syslog.7.gz
andrew@server:~/Downloads$

I upgraded to 12.10 on Saturday/Sunday.

So I attempted to look at dmesg, well, dmesg reports things correctly. So I looked at daemon.log, mail.*, messages, ufw.log, and user.log. All are empty, and have been for the past couple days, or haven't ran a new file since the 12th of November.

So I listed off the packages that had syslog in the name:

andrew@server:~/Downloads$ dpkg -l | grep syslog
rc  inetutils-syslogd                        2:1.8-6                                      amd64        system logging daemon
ii  rsyslog                                  5.8.6-1ubuntu9                               amd64        reliable system and kernel logging daemon

I thought, okay, well, I will double check inetutils-syslogd and try to reinstall it and rsyslog:

andrew@server:~/Downloads$ sudo apt-get install inetutils-syslogd rsyslog
Reading package lists... Done
Building dependency tree       
Reading state information... Done
rsyslog is already the newest version.
Some packages could not be installed. This may mean that you have
requested an impossible situation or if you are using the unstable
distribution that some required packages have not yet been created
or been moved out of Incoming.
The following information may help to resolve the situation:

The following packages have unmet dependencies:
 inetutils-syslogd : Conflicts: linux-kernel-log-daemon
                     Conflicts: system-log-daemon
 rsyslog : Conflicts: linux-kernel-log-daemon
           Conflicts: system-log-daemon
E: Unable to correct problems, you have held broken packages.

So, then I thought I would just install syslogd:

andrew@server:~/Downloads$ sudo apt-get install inetutils-syslogd 
Reading package lists... Done
Building dependency tree       
Reading state information... Done
The following packages will be REMOVED:
  rsyslog ubuntu-minimal
The following NEW packages will be installed:
  inetutils-syslogd
0 upgraded, 1 newly installed, 2 to remove and 0 not upgraded.
Need to get 58.7 kB of archives.
After this operation, 1,027 kB disk space will be freed.
Do you want to continue [Y/n]? 
Get:1 http://us.archive.ubuntu.com/ubuntu/ quantal/universe inetutils-syslogd amd64 2:1.9-1 [58.7 kB]
Fetched 58.7 kB in 0s (295 kB/s)       
(Reading database ... 177144 files and directories currently installed.)
Removing ubuntu-minimal ...
dpkg: rsyslog: dependency problems, but removing anyway as you requested:
 inetutils-telnetd depends on inetutils-syslogd | system-log-daemon; however:
  Package inetutils-syslogd is not installed.
  Package system-log-daemon is not installed.
  Package rsyslog which provides system-log-daemon is to be removed.
  Package inetutils-syslogd which provides system-log-daemon is not installed.
 inetutils-talkd depends on inetutils-syslogd | system-log-daemon; however:
  Package inetutils-syslogd is not installed.
  Package system-log-daemon is not installed.
  Package rsyslog which provides system-log-daemon is to be removed.
  Package inetutils-syslogd which provides system-log-daemon is not installed.
 inetutils-ftpd depends on inetutils-syslogd | system-log-daemon; however:
  Package inetutils-syslogd is not installed.
  Package system-log-daemon is not installed.
  Package rsyslog which provides system-log-daemon is to be removed.
  Package inetutils-syslogd which provides system-log-daemon is not installed.
 inetu
Removing rsyslog ...
rsyslog stop/waiting
Processing triggers for ureadahead ...
Processing triggers for man-db ...
Selecting previously unselected package inetutils-syslogd.
(Reading database ... 177102 files and directories currently installed.)
Unpacking inetutils-syslogd (from .../inetutils-syslogd_2%3a1.9-1_amd64.deb) ...
Processing triggers for ureadahead ...
Processing triggers for man-db ...
Setting up inetutils-syslogd (2:1.9-1) ...
 * Starting system log daemon syslogd

I really need some help in making sure everything is working correctly after this latest update. It seems to have broken quite a few different things, and I am not sure what else might be broken/missing because of it. At the moment, I don't know if syslog is really running correctly. Or if any of the other things I log (DHCP, DNS, Apache, etc) are working either, as that was the main reason I use logwatcher was to e-mail me results from those.

[SteveRiley]

inetutils-syslogd and rsyslog conflict with each other, they can't both be installed at the same time. And to add to the confusion, system-log-daemon and linux-kernel-log-daemon are virtual packages that point to all available sysloggers, but the various dependencies are structured in a way that makes the virtual packages abide by the only-one-logger restriction.

On my machine, only rsyslog is installed, which is the Ubuntu default. Your dpkg output shows that inetutils-syslogd was installed at one time, but then removed. Do you recall why you might have installed that?

Let's at least return you to the default. Don't worry if some of the rm commands fail -- I'm erring on the side of caution, and having you remove any residual config files that might exist.

sudo apt-get purge inetutils-syslogd
sudo rm -rfv /etc/rsyslog.conf /etc/rsyslog.d /etc/default/rsyslog /etc/init/rsyslog.conf /etc/init.d/rsyslog
sudo apt-get install rsyslog ubuntu-minimal

Reboot your computer. If your syslog doesn't resume filling up, then we have additional troubleshooting to perform.