Mailing List Archive

rsyslog-8.1904.0-1.el6.x86_64 stopped and not starting up
Hi All,
Experiencing a strange issue where rsyslog-8.1904.0-1.el6.x86_64 stopped at 9:08am (EDT) and not starting up on all the 4 servers which have been running ok for weeks. Tried starting it again but it stopped again.
Any way to troubleshoot issue?
Thanks.
Best Regards,
Mike Li

Confidentiality Notice:: This email, including attachments, may include non-public, proprietary, confidential or legally privileged information. If you are not an intended recipient or an authorized agent of an intended recipient, you are hereby notified that any dissemination, distribution or copying of the information contained in or transmitted with this e-mail is unauthorized and strictly prohibited. If you have received this email in error, please notify the sender by replying to this message and permanently delete this e-mail, its attachments, and any copies of it immediately. You should not retain, copy or use this e-mail or any attachment for any purpose, nor disclose all or any part of the contents to any other person. Thank you.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Re: rsyslog-8.1904.0-1.el6.x86_64 stopped and not starting up [ In reply to ]
we would need to see the configs and/or a debug log to make a guess as to what's
happening.

David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Re: rsyslog-8.1904.0-1.el6.x86_64 stopped and not starting up [ In reply to ]
Hi David,
Read https://www.rsyslog.com/doc/v8-stable/troubleshooting/debug.html
Just to confirm:
I could set up following in /etc/rsyslog.conf
$DebugFile '/var/log/rsyslog/LOCALHOST.LOCALDOMAIN/rsyslog.log'
$DebugLevel 1

Then issue kill -USR1 $(cat /var/run/rsyslogd.pid) to enable the logging?
What is the command to stop the logging? Service rsyslog restart ?

Thanks
Mike

-----Original Message-----
From: David Lang <david@lang.hm>
Sent: Friday, August 16, 2019 11:30 AM
To: Li, Mike via rsyslog <rsyslog@lists.adiscon.com>
Cc: Li, Mike <Mike.Li@finra.org>
Subject: Re: [rsyslog] rsyslog-8.1904.0-1.el6.x86_64 stopped and not starting up

EXTERNAL: Verify sender before opening attachments or links.

we would need to see the configs and/or a debug log to make a guess as to what's happening.

David Lang

Confidentiality Notice:: This email, including attachments, may include non-public, proprietary, confidential or legally privileged information. If you are not an intended recipient or an authorized agent of an intended recipient, you are hereby notified that any dissemination, distribution or copying of the information contained in or transmitted with this e-mail is unauthorized and strictly prohibited. If you have received this email in error, please notify the sender by replying to this message and permanently delete this e-mail, its attachments, and any copies of it immediately. You should not retain, copy or use this e-mail or any attachment for any purpose, nor disclose all or any part of the contents to any other person. Thank you.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Re: rsyslog-8.1904.0-1.el6.x86_64 stopped and not starting up [ In reply to ]
There is no kill SIGUSR1 in
AME="Amazon Linux AMI"
VERSION="2018.03"
ID="amzn"
ID_LIKE="rhel fedora"

What is the equivalent from the following options: usage: kill [-s sigspec | -n signum | -sigspec] pid | jobspec ... or kill -l [sigspec]
Thanks
Mike
-----Original Message-----
From: rsyslog <rsyslog-bounces@lists.adiscon.com> On Behalf Of Li, Mike via rsyslog
Sent: Friday, August 16, 2019 1:39 PM
To: David Lang <david@lang.hm>; Li, Mike via rsyslog <rsyslog@lists.adiscon.com>
Cc: Li, Mike <Mike.Li@finra.org>
Subject: Re: [rsyslog] rsyslog-8.1904.0-1.el6.x86_64 stopped and not starting up

EXTERNAL: Verify sender before opening attachments or links.

Hi David,
Read https://www.rsyslog.com/doc/v8-stable/troubleshooting/debug.html
Just to confirm:
I could set up following in /etc/rsyslog.conf $DebugFile '/var/log/rsyslog/LOCALHOST.LOCALDOMAIN/rsyslog.log'
$DebugLevel 1

Then issue kill -USR1 $(cat /var/run/rsyslogd.pid) to enable the logging?
What is the command to stop the logging? Service rsyslog restart ?

Thanks
Mike

-----Original Message-----
From: David Lang <david@lang.hm>
Sent: Friday, August 16, 2019 11:30 AM
To: Li, Mike via rsyslog <rsyslog@lists.adiscon.com>
Cc: Li, Mike <Mike.Li@finra.org>
Subject: Re: [rsyslog] rsyslog-8.1904.0-1.el6.x86_64 stopped and not starting up

EXTERNAL: Verify sender before opening attachments or links.

we would need to see the configs and/or a debug log to make a guess as to what's happening.

David Lang

Confidentiality Notice:: This email, including attachments, may include non-public, proprietary, confidential or legally privileged information. If you are not an intended recipient or an authorized agent of an intended recipient, you are hereby notified that any dissemination, distribution or copying of the information contained in or transmitted with this e-mail is unauthorized and strictly prohibited. If you have received this email in error, please notify the sender by replying to this message and permanently delete this e-mail, its attachments, and any copies of it immediately. You should not retain, copy or use this e-mail or any attachment for any purpose, nor disclose all or any part of the contents to any other person. Thank you.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Re: rsyslog-8.1904.0-1.el6.x86_64 stopped and not starting up [ In reply to ]
> Then issue kill -USR1 $(cat /var/run/rsyslogd.pid) to enable the logging?
> What is the command to stop the logging? Service rsyslog restart ?

USR1 is a toggle, send it once to turn the logging on, and again to turn it off.

Since you are not starting up, in this case, a debug log from -dn on the command
line will probably be better than trying to send it a signal after it starts

Dvaid Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Re: rsyslog-8.1904.0-1.el6.x86_64 stopped and not starting up [ In reply to ]
kill -USR1 pid should work on any *nix system

what are you doing that's giving you the idea that it doesn't?

David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Re: rsyslog-8.1904.0-1.el6.x86_64 stopped and not starting up [ In reply to ]
David,
Rsyslog does start up but it stops after some time. I used the 2 lines in /etc/rsyslog.conf
$DebugFile '/var/log/rsyslog/LOCALHOST.LOCALDOMAIN/rsyslog.log'
$DebugLevel 1

And did kill -USR1 $(cat /var/run/syslogd.pid)
I don't see any entries in /var/log/rsyslog/LOCALHOST.LOCALDOMAIN/rsyslog.log
Even though rsyslog stopped during that time
Thanks
Mike
-----Original Message-----
From: David Lang <david@lang.hm>
Sent: Friday, August 16, 2019 2:00 PM
To: Li, Mike <Mike.Li@finra.org>
Cc: David Lang <david@lang.hm>; Li, Mike via rsyslog <rsyslog@lists.adiscon.com>
Subject: RE: [rsyslog] rsyslog-8.1904.0-1.el6.x86_64 stopped and not starting up

EXTERNAL: Verify sender before opening attachments or links.

> Then issue kill -USR1 $(cat /var/run/rsyslogd.pid) to enable the logging?
> What is the command to stop the logging? Service rsyslog restart ?

USR1 is a toggle, send it once to turn the logging on, and again to turn it off.

Since you are not starting up, in this case, a debug log from -dn on the command line will probably be better than trying to send it a signal after it starts

Dvaid Lang

Confidentiality Notice:: This email, including attachments, may include non-public, proprietary, confidential or legally privileged information. If you are not an intended recipient or an authorized agent of an intended recipient, you are hereby notified that any dissemination, distribution or copying of the information contained in or transmitted with this e-mail is unauthorized and strictly prohibited. If you have received this email in error, please notify the sender by replying to this message and permanently delete this e-mail, its attachments, and any copies of it immediately. You should not retain, copy or use this e-mail or any attachment for any purpose, nor disclose all or any part of the contents to any other person. Thank you.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.