similar to: systemd-journald corruption

Once upon a time, Chris Murphy <lists at colorremedies.com> said: > On Tue, Apr 26, 2016, 2:09 PM Chris Adams <linux at cmadams.net> wrote: > > I have several recently-installed CentOS 7 servers that keep having > > systemd-journald corruption > > Determined with 'journalctl --verify' or another way? I get messages like this in dmesg: [4756650.489117]

Once upon a time, Chris Murphy <lists at colorremedies.com> said: > On Tue, Apr 26, 2016 at 3:01 PM, Chris Adams <linux at cmadams.net> wrote: > > Once upon a time, Chris Murphy <lists at colorremedies.com> said: > >> On Tue, Apr 26, 2016, 2:09 PM Chris Adams <linux at cmadams.net> wrote: > >> > I have several recently-installed CentOS 7

Once upon a time, Chris Murphy <lists at colorremedies.com> said: > Also I wonder if merely restarting the journal daemon solves it: > > systemctl restart systemd-journald > > What should happen is it realizes its own logs are corrupt and ignores > them, and starts working on new copies. And journalctl should still > try to read the old ones but skips the corrupt

On Tue, Apr 26, 2016, 2:09 PM Chris Adams <linux at cmadams.net> wrote: > I have several recently-installed CentOS 7 servers that keep having > systemd-journald corruption Determined with 'journalctl --verify' or another way? (which stops ALL logging, including syslog). > Interestingly, they are all spam-scanning servers running amavisd-new > (so could be some

On Tue, Apr 26, 2016 at 3:01 PM, Chris Adams <linux at cmadams.net> wrote: > Once upon a time, Chris Murphy <lists at colorremedies.com> said: >> On Tue, Apr 26, 2016, 2:09 PM Chris Adams <linux at cmadams.net> wrote: >> > I have several recently-installed CentOS 7 servers that keep having >> > systemd-journald corruption >> >> Determined

On Wed, Apr 27, 2016 at 7:05 AM, Chris Adams <linux at cmadams.net> wrote: > Once upon a time, Chris Murphy <lists at colorremedies.com> said: >> On Tue, Apr 26, 2016 at 3:01 PM, Chris Adams <linux at cmadams.net> wrote: >> > Once upon a time, Chris Murphy <lists at colorremedies.com> said: >> >> On Tue, Apr 26, 2016, 2:09 PM Chris Adams

On Tue, Oct 13, 2015 at 2:35 PM, Jonathan Billings <billings at negate.org> wrote: > On Tue, Oct 13, 2015 at 02:04:49PM +0000, C. L. Martinez wrote: >> And according to systemd, without problems: >> >> crond.service - Command Scheduler >> Loaded: loaded (/usr/lib/systemd/system/crond.service; enabled) >> Active: active (running) since Tue 2015-10-13

On 18.03.23 14:34, David Lang wrote: > modern syslog daemons (including rsyslog, which is default on just > about every linux system) allow you to filter efficiently on the > message contents, not just the severity, so you can opt to throw out > the messages you don't want. > > I advocate for a slightly different way of dealing with it, filter > these messages from

Hi all, I have 5 CentOS 7 virtual guests installed (all fully patched to latest release) and i have the following error in all of them: systemd-journald[7779]: File /run/log/journal/b4a41f4214ca44f898638301891a6f2e/system.journal corrupted or uncleanly shut down, renaming and replacing. ?? .. And I don't understand why. I have configured "Storage=volatile" in journald.conf ...

On 10/13/2015 02:59 PM, Jonathan Billings wrote: > On Tue, Oct 13, 2015 at 02:39:24PM +0000, C. L. Martinez wrote: >> Nop, because binary logs (using journalctl) are disabled in this host >> ... But under /var/log/messages, there is no error ... > > How did you disable journald? > Changing Storage's option under /etc/systemd/journald.conf to none.

Hi, My rsyslog is not working as expected. I have some thing in rsyslog.d that do well, like this: # Log all iptables stuff separately :msg, contains, "iptables: " { action(type="omfile" file="/var/log/iptraf/info") } No problems with that. Bu what's in /etc/rsyslog.conf like: mail.* /var/log/mail/info don't do anything at all. Rsyslogd -N1 is OK,

Once upon a time, Chris Adams <linux at cmadams.net> said: > So far, turning off the compression appears to have worked (but I'll > have to watch it for a day or two to really see). Just to follow up: turning off journald compression does appear to have fixed the corruption problem I was seeing. I'll watch for an updated systemd package. -- Chris Adams <linux at

On 10/14/2015 01:56 PM, Jonathan Billings wrote: > lsof /dev/log Uhmm ... that is not what I expect: lsof: WARNING: can't stat() fuse.gvfsd-fuse file system /run/user/1000/gvfs Output information may be incomplete. COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME systemd 1 root 27u unix 0xffff880250ea0f00 0t0 1436 /dev/log systemd-j 263 root 5u

I have a rsyslog-based log server and would like to know how I can configure journalctl to send its logs to said log server.

CentOS Linux release 7.2.1511 (Core) Hi, Last night our CentOS 7 server rebooted. Seemingly it's a very clean reboot. I can't find a shred of evidence as to why it happened though. Things I've checked: * sa reports * /var/log/{messages,secure,dmesg,cron} * /var/log/audit/audit.log * lastlog The host is used for KVM virtualisation and connects via multipathing to our OmniOS SAN via

modern syslog daemons (including rsyslog, which is default on just about every linux system) allow you to filter efficiently on the message contents, not just the severity, so you can opt to throw out the messages you don't want. I advocate for a slightly different way of dealing with it, filter these messages from your main logstream, but put them into either a script directly, or a

Attempting to lookup why rsyslogd is listening on the high port UDP/51427. Have not succeeded in what this port is used for and what directive controls what interface it binds to. [root at bedrock ~]# netstat --listen --inet --program --numeric | grep syslog udp??0??0 0.0.0.0:51427??0.0.0.0:*???66655/rsyslogd? -- Adam Tauno Williams <mailto:awilliam at whitemice.org> GPG D95ED383

centos 6.4, setup to be syslog server. Doing remote syslog using tcp works fine, so now want to add relp. I installed the rsyslog-relp package and told rsyslog.conf to use it: # RELP Syslog Server: $ModLoad imrelp # provides RELP syslog reception $InputRELPServerRun 20514 when I restart rsyslog I am told it does not like my InputRELPServerRun line: Oct 28 13:43:54 scan rsyslogd: [origin

Hello everyone, We have some chrooted sftp-only users on a CentOS release 6.6 server. The server had been logging their actions, but after recent updates the logs have stopped. The server correctly logs non-chrooted users: Sep 14 17:47:24 vsecure4 sshd[1981]: Accepted publickey for jcours from 192.168.10.166 port 42545 ssh2 Sep 14 17:47:24 vsecure4 sshd[1981]: pam_unix(sshd:session):

I hoped I don't have to switch to syslog logging. Well, anyway. I changed 10-logging.conf: syslog_facility = uucp and commented out the other log lines. rsyslog.d/50-default.conf: uucp.debug -/var/log/dovecot/debug.log uucp.info -/var/log/dovecot/dovecot.log uucp.warn -/var/log/dovecot/warn.log uucp.err