syslog disappeared
- Thread starter michabbs
- Start date
Does the journal show you something If you open the syslog page in the WebUI?
Then open syslog in the PMGs WebUI.
...Browsercache has already been emptied for a test?
The permissions on the syslog file might also be helpful:
Does the tracking center work?
https://pmg.proxmox.com/pmg-docs/pmg-admin-guide.html#pmg_tracking_center
Code:
journalctl -fThen open syslog in the PMGs WebUI.
...Browsercache has already been emptied for a test?
The permissions on the syslog file might also be helpful:
Code:
ls -l /var/log/syslogDoes the tracking center work?
https://pmg.proxmox.com/pmg-docs/pmg-admin-guide.html#pmg_tracking_center
Nothing seems to be related directly to me entering the syslog page in UI, but sometimes I can see this:
Code:
Sep 08 13:54:58 bester pmgdaemon[40904]: problem with client ::ffff:*MY_IP_ADDRESS*; Broken pipeAlso, when do
systemctl restart rsyslog I get this:
Code:
Sep 08 13:29:41 bester rsyslogd[112279]: imuxsock: Acquired UNIX socket '/run/systemd/journal/syslog' (fd 3) from systemd. [v8.2504.0]
Sep 08 13:29:41 bester rsyslogd[112279]: imklog: cannot open kernel log (/proc/kmsg): Permission denied.
Sep 08 13:29:41 bester rsyslogd[112279]: activation of module imklog failed [v8.2504.0 try https://www.rsyslog.com/e/2145 ]Does it mean anything important?
-rw-r--r-- 1 root root 22604841 Sep 8 13:59 /var/log/syslogYes, no problem.
The GUI syslog view does not read /var/log/syslog at all. It streams from the systemd journal (journald), so the file being readable only proves that rsyslog or something similar is still writing the file. That split is exactly what you see when the journal itself is the problem.
Worth checking on the node first:
journalctl --no-pager -n 20
ls -la /var/log/journal
If journalctl also shows nothing useful (or only the current boot), the persistent journal is missing or empty. After upgrades this sometimes ends up with journald keeping everything in /run/log/journal (volatile, wiped at every boot) or with no /var/log/journal directory present at all. What has fixed it for me on other boxes:
mkdir -p /var/log/journal
systemd-tmpfiles --create --prefix /var/log/journal
systemctl restart systemd-journald
Then look at /etc/systemd/journald.conf. Storage=persistent (or auto with the directory existing) is what you want on a node you administer over the GUI, then restart systemd-journald once more. After that the Administration -> Syslog panel usually fills in immediately, no pveproxy restart needed.
If journalctl looks fine from the shell but the panel stays blank, the problem is on the API/browser side rather than the logging side. Keeping journalctl -f open in a second SSH session while reloading the panel shows within seconds whether new entries even reach the journal.
Personally I keep rsyslog installed on my nodes mainly so I still get the plain /var/log/syslog file for quick grepping, but the GUI never reads that file, so the two views can disagree exactly the way you describe.
Worth checking on the node first:
journalctl --no-pager -n 20
ls -la /var/log/journal
If journalctl also shows nothing useful (or only the current boot), the persistent journal is missing or empty. After upgrades this sometimes ends up with journald keeping everything in /run/log/journal (volatile, wiped at every boot) or with no /var/log/journal directory present at all. What has fixed it for me on other boxes:
mkdir -p /var/log/journal
systemd-tmpfiles --create --prefix /var/log/journal
systemctl restart systemd-journald
Then look at /etc/systemd/journald.conf. Storage=persistent (or auto with the directory existing) is what you want on a node you administer over the GUI, then restart systemd-journald once more. After that the Administration -> Syslog panel usually fills in immediately, no pveproxy restart needed.
If journalctl looks fine from the shell but the panel stays blank, the problem is on the API/browser side rather than the logging side. Keeping journalctl -f open in a second SSH session while reloading the panel shows within seconds whether new entries even reach the journal.
Personally I keep rsyslog installed on my nodes mainly so I still get the plain /var/log/syslog file for quick grepping, but the GUI never reads that file, so the two views can disagree exactly the way you describe.