{"id":1019,"date":"2021-07-16T07:20:53","date_gmt":"2021-07-16T12:20:53","guid":{"rendered":"https:\/\/www.knownhost.com\/kb\/?p=1019"},"modified":"2021-09-28T06:20:33","modified_gmt":"2021-09-28T11:20:33","slug":"how-to-fix-syslog-failed-message","status":"publish","type":"post","link":"https:\/\/www.knownhost.com\/kb\/how-to-fix-syslog-failed-message\/","title":{"rendered":"How to fix SYSLOG failed message"},"content":{"rendered":"\n<p>If you are receiving the following messages from your cPanel server, an ongoing rsyslog bug has updated the configuration in such a way that it disabled local logging:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>  lfd on host.domain.tld: SYSLOG Check Failed\n\n  Time: Thu Jun 13 02:57:23 2019 -0400\n  Error: Failed to detect code &#91;YHt8VYSQnJ6KBc6ELafzIsUeNw] in SYSLOG_LOG &#91;\/var\/log\/messages]\n\n  SYSLOG may not be running correctly on host.domain.tld<\/code><\/pre>\n\n\n\n<p>First, you should go ahead and check the current log and the rotated logs to see if maybe the log rotated at the same time the check was being done:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>  grep $code \/var\/log\/messages\n  zgrep $code \/var\/log\/messages-*<\/code><\/pre>\n\n\n\n<p>The following example demonstrates that the code has not been logged at all:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>  &#91;root@host ~]# grep YHt8VYSQnJ6KBc6ELafzIsUeNw \/var\/log\/messages\n  &#91;root@host ~]# grep YHt8VYSQnJ6KBc6ELafzIsUeNw \/var\/log\/messages-20190\n  messages-20190519  messages-20190526  messages-20190602  messages-20190609  \n  &#91;root@host ~]# grep YHt8VYSQnJ6KBc6ELafzIsUeNw \/var\/log\/messages-20190*\n  &#91;root@host ~]# <\/code><\/pre>\n\n\n\n<p>Had the code been logged, you would want to check the iowait and load on the server to determine if the server is just running too slowly to have completed the check within 5 minutes time.<\/p>\n\n\n\n<p>Next, we should check to see that the rsyslog service is running since it isn&#8217;t writing to the file:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>  &#91;root@host ~]# \/scripts\/restartsrv_rsyslogd --check \n  The 'rsyslog' service passed the check: \n    rsyslog (\/usr\/sbin\/rsyslogd -n) is running as root with PID 594 (systemd+\/proc check method).\n  &#91;root@host ~]# ps auxf | grep rsyslog\n  root     31446  0.0  0.0   9040   820 pts\/0    S+   04:35   0:00          \\_ grep --color=auto rsyslog\n  root       594  0.0  0.0 356936  2464 ?        Ssl  Jun11   0:05 \/usr\/sbin\/rsyslogd -n\n  &#91;root@host ~]# <\/code><\/pre>\n\n\n\n<p>It is running according to the checks done. Next, we should check to see if the PID of the running process actually matches the PID in the PID file (it occasionally happens when this is the cause of such failures, such as when there are two instances of the same service running):<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>  &#91;root@host ~]# cat \/var\/run\/syslogd.pid \n  594&#91;root@host ~]# <\/code><\/pre>\n\n\n\n<p>The PID matches. Now, let&#8217;s check to see if we can force rsyslog to log a message for us:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>  &#91;root@host ~]# logger -p auth.notice \"test123\"\n  &#91;root@host ~]# grep \"test123\" \/var\/log\/messages\n  &#91;root@host ~]#<\/code><\/pre>\n\n\n\n<p>It failed to write the message to the log for us. You should see this instead:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>  &#91;root@host support]# logger -p auth.notice \"test123\"\n  &#91;root@host support]# grep \"test123\" \/var\/log\/messages\n  Jun 13 04:38:23 host root: test123<\/code><\/pre>\n\n\n\n<p>This does appear to be the bug that causes local logging to be disabled\/misconfigured. Let&#8217;s check the configuration to confirm:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>  &#91;root@host ~]# grep -i \"OmitLocalLogging\\|ModLoad imjournal\\|IMJournalStateFile\" \/etc\/rsyslog.conf\n  $ModLoad imjournal # provides access to the systemd journal\n  $OmitLocalLogging on\n  $IMJournalStateFile imjournal.state\n  &#91;root@host ~]# <\/code><\/pre>\n\n\n\n<p>The output confirms this. Now, we will make a backup of the configuration file, correct the configuration files, and then restart the service to correct this issue:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>  &#91;root@host ~]# cp \/etc\/rsyslog.conf \/etc\/rsyslog.conf.bak \n  &#91;root@host ~]# sed -i 's\/OmitLocalLogging on\/OmitLocalLogging off\/' \/etc\/rsyslog.conf\n  &#91;root@host ~]# sed -i 's\/$IMJournalStateFile imjournal.state\/#$IMJournalStateFile imjournal.state\/' \n    \/etc\/rsyslog.conf\n  &#91;root@host ~]# sed -i 's\/$ModLoad imjournal\/#$ModLoad imjournal\/' \/etc\/rsyslog.conf\n  &#91;root@host ~]# \/scripts\/restartsrv_rsyslog\n  Waiting for \u201crsyslog\u201d to restart \u2026\u2026\u2026waiting for \u201crsyslog\u201d to initialize \u2026\u2026\u2026finished.\n\n  Service Status\n\trsyslog (\/usr\/sbin\/rsyslogd -n) is running as root with PID 31621 (systemd+\/proc check method).\n\n  Startup Log\n\tJun 13 08:43:40 host systemd&#91;1]: Starting System Logging Service...\n\tJun 13 08:43:40 host rsyslogd&#91;31621]:  \n          &#91;origin software=\"rsyslogd\" swVersion=\"8.24.0-34.el7\" x-pid=\"31621\" x- \n info=\"http:\/\/www.rsyslog.com\"] start\n\tJun 13 08:43:40 host systemd&#91;1]: Started System Logging Service.\n\n  rsyslog restarted successfully.\n  &#91;root@host ~]# systemctl restart systemd-journald\n  &#91;root@host ~]# <\/code><\/pre>\n\n\n\n<p>Now, retest. You should now see your test logging message:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>  &#91;root@host ~]# logger -p auth.notice \"testing123\" &amp;&amp; grep testing \/var\/log\/messages\n  Jun 13 04:44:08 host root: testing123\n  &#91;root@host ~]# <\/code><\/pre>\n\n\n\n<p>You can see now that the code was indeed detected correctly.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>If you are receiving the following messages from your cPanel server, an ongoing rsyslog bug has updated the configuration in such a way that it disabled local logging: First, you should go ahead and check the current log and the rotated logs to see if maybe the log rotated at the same time the check [&hellip;]<\/p>\n","protected":false},"author":4,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[94],"tags":[177,143,123,124,125],"class_list":["post-1019","post","type-post","status-publish","format-standard","hentry","category-common-issues","tag-cloud","tag-dedicated","tag-linux","tag-syslogd","tag-vps"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.5 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>How to fix SYSLOG failed message - KnownHost<\/title>\n<meta name=\"description\" content=\"Want to learn more about what syslog is and how to fix the syslog failed message? In this guide we will show you how to fix syslog.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.knownhost.com\/kb\/how-to-fix-syslog-failed-message\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"How to fix SYSLOG failed message - KnownHost\" \/>\n<meta property=\"og:description\" content=\"Want to learn more about what syslog is and how to fix the syslog failed message? In this guide we will show you how to fix syslog.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.knownhost.com\/kb\/how-to-fix-syslog-failed-message\/\" \/>\n<meta property=\"og:site_name\" content=\"KnownHost\" \/>\n<meta property=\"article:published_time\" content=\"2021-07-16T12:20:53+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2021-09-28T11:20:33+00:00\" \/>\n<meta name=\"author\" content=\"Jonathan K. W.\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Jonathan K. W.\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.knownhost.com\\\/kb\\\/how-to-fix-syslog-failed-message\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.knownhost.com\\\/kb\\\/how-to-fix-syslog-failed-message\\\/\"},\"author\":{\"name\":\"Jonathan K. W.\",\"@id\":\"https:\\\/\\\/www.knownhost.com\\\/kb\\\/#\\\/schema\\\/person\\\/3db6e20d1f33519cd68fe0ba1230a48b\"},\"headline\":\"How to fix SYSLOG failed message\",\"datePublished\":\"2021-07-16T12:20:53+00:00\",\"dateModified\":\"2021-09-28T11:20:33+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.knownhost.com\\\/kb\\\/how-to-fix-syslog-failed-message\\\/\"},\"wordCount\":287,\"keywords\":[\"cloud\",\"dedicated\",\"linux\",\"syslogd\",\"vps\"],\"articleSection\":[\"Common Issues\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.knownhost.com\\\/kb\\\/how-to-fix-syslog-failed-message\\\/\",\"url\":\"https:\\\/\\\/www.knownhost.com\\\/kb\\\/how-to-fix-syslog-failed-message\\\/\",\"name\":\"How to fix SYSLOG failed message - KnownHost\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.knownhost.com\\\/kb\\\/#website\"},\"datePublished\":\"2021-07-16T12:20:53+00:00\",\"dateModified\":\"2021-09-28T11:20:33+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/www.knownhost.com\\\/kb\\\/#\\\/schema\\\/person\\\/3db6e20d1f33519cd68fe0ba1230a48b\"},\"description\":\"Want to learn more about what syslog is and how to fix the syslog failed message? In this guide we will show you how to fix syslog.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.knownhost.com\\\/kb\\\/how-to-fix-syslog-failed-message\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.knownhost.com\\\/kb\\\/how-to-fix-syslog-failed-message\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.knownhost.com\\\/kb\\\/how-to-fix-syslog-failed-message\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.knownhost.com\\\/kb\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"How to fix SYSLOG failed message\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.knownhost.com\\\/kb\\\/#website\",\"url\":\"https:\\\/\\\/www.knownhost.com\\\/kb\\\/\",\"name\":\"KnownHost\",\"description\":\"KnownHost provides a comprehensive webhosting knowledge base to help answer many of your common webhosting and linux questions.\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.knownhost.com\\\/kb\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.knownhost.com\\\/kb\\\/#\\\/schema\\\/person\\\/3db6e20d1f33519cd68fe0ba1230a48b\",\"name\":\"Jonathan K. W.\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/f432b99e6651fe8d1deb57a285bd84e806f1c9ae8b4c6c585d7e3a0b33789ad9?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/f432b99e6651fe8d1deb57a285bd84e806f1c9ae8b4c6c585d7e3a0b33789ad9?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/f432b99e6651fe8d1deb57a285bd84e806f1c9ae8b4c6c585d7e3a0b33789ad9?s=96&d=mm&r=g\",\"caption\":\"Jonathan K. W.\"},\"sameAs\":[\"https:\\\/\\\/www.knownhost.com\"]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"How to fix SYSLOG failed message - KnownHost","description":"Want to learn more about what syslog is and how to fix the syslog failed message? In this guide we will show you how to fix syslog.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.knownhost.com\/kb\/how-to-fix-syslog-failed-message\/","og_locale":"en_US","og_type":"article","og_title":"How to fix SYSLOG failed message - KnownHost","og_description":"Want to learn more about what syslog is and how to fix the syslog failed message? In this guide we will show you how to fix syslog.","og_url":"https:\/\/www.knownhost.com\/kb\/how-to-fix-syslog-failed-message\/","og_site_name":"KnownHost","article_published_time":"2021-07-16T12:20:53+00:00","article_modified_time":"2021-09-28T11:20:33+00:00","author":"Jonathan K. W.","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Jonathan K. W.","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.knownhost.com\/kb\/how-to-fix-syslog-failed-message\/#article","isPartOf":{"@id":"https:\/\/www.knownhost.com\/kb\/how-to-fix-syslog-failed-message\/"},"author":{"name":"Jonathan K. W.","@id":"https:\/\/www.knownhost.com\/kb\/#\/schema\/person\/3db6e20d1f33519cd68fe0ba1230a48b"},"headline":"How to fix SYSLOG failed message","datePublished":"2021-07-16T12:20:53+00:00","dateModified":"2021-09-28T11:20:33+00:00","mainEntityOfPage":{"@id":"https:\/\/www.knownhost.com\/kb\/how-to-fix-syslog-failed-message\/"},"wordCount":287,"keywords":["cloud","dedicated","linux","syslogd","vps"],"articleSection":["Common Issues"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.knownhost.com\/kb\/how-to-fix-syslog-failed-message\/","url":"https:\/\/www.knownhost.com\/kb\/how-to-fix-syslog-failed-message\/","name":"How to fix SYSLOG failed message - KnownHost","isPartOf":{"@id":"https:\/\/www.knownhost.com\/kb\/#website"},"datePublished":"2021-07-16T12:20:53+00:00","dateModified":"2021-09-28T11:20:33+00:00","author":{"@id":"https:\/\/www.knownhost.com\/kb\/#\/schema\/person\/3db6e20d1f33519cd68fe0ba1230a48b"},"description":"Want to learn more about what syslog is and how to fix the syslog failed message? In this guide we will show you how to fix syslog.","breadcrumb":{"@id":"https:\/\/www.knownhost.com\/kb\/how-to-fix-syslog-failed-message\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.knownhost.com\/kb\/how-to-fix-syslog-failed-message\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.knownhost.com\/kb\/how-to-fix-syslog-failed-message\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.knownhost.com\/kb\/"},{"@type":"ListItem","position":2,"name":"How to fix SYSLOG failed message"}]},{"@type":"WebSite","@id":"https:\/\/www.knownhost.com\/kb\/#website","url":"https:\/\/www.knownhost.com\/kb\/","name":"KnownHost","description":"KnownHost provides a comprehensive webhosting knowledge base to help answer many of your common webhosting and linux questions.","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.knownhost.com\/kb\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/www.knownhost.com\/kb\/#\/schema\/person\/3db6e20d1f33519cd68fe0ba1230a48b","name":"Jonathan K. W.","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/f432b99e6651fe8d1deb57a285bd84e806f1c9ae8b4c6c585d7e3a0b33789ad9?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/f432b99e6651fe8d1deb57a285bd84e806f1c9ae8b4c6c585d7e3a0b33789ad9?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/f432b99e6651fe8d1deb57a285bd84e806f1c9ae8b4c6c585d7e3a0b33789ad9?s=96&d=mm&r=g","caption":"Jonathan K. W."},"sameAs":["https:\/\/www.knownhost.com"]}]}},"_links":{"self":[{"href":"https:\/\/www.knownhost.com\/kb\/wp-json\/wp\/v2\/posts\/1019","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.knownhost.com\/kb\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.knownhost.com\/kb\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.knownhost.com\/kb\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/www.knownhost.com\/kb\/wp-json\/wp\/v2\/comments?post=1019"}],"version-history":[{"count":0,"href":"https:\/\/www.knownhost.com\/kb\/wp-json\/wp\/v2\/posts\/1019\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.knownhost.com\/kb\/wp-json\/wp\/v2\/media?parent=1019"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.knownhost.com\/kb\/wp-json\/wp\/v2\/categories?post=1019"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.knownhost.com\/kb\/wp-json\/wp\/v2\/tags?post=1019"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}