특정 파일의 로그를 syslog서버로 전달하도록 rsyslog를 구성하려고 하다가 결국 전체 구성을 제거했습니다(rsyslog 서비스가 중단되어 시작되지 않음)..
그래서 모든 것을 제거하고 모든 것을 처음부터 다시 설치했습니다. 이제 시작하려고 하면 실패합니다.
OS 버전은 다음과 같습니다.
~# cat /etc/os-release
PRETTY_NAME="Debian GNU/Linux 10 (buster)"
NAME="Debian GNU/Linux"
VERSION_ID="10"
VERSION="10 (buster)"
VERSION_CODENAME=buster
ID=debian
HOME_URL="https://www.debian.org/"
SUPPORT_URL="https://www.debian.org/support"
BUG_REPORT_URL="https://bugs.debian.org/"
여기 rsyslog 버전이 있습니다
~# rsyslogd -v
rsyslogd 8.2212.0 (aka 2022.12) compiled with:
PLATFORM: x86_64-pc-linux-gnu
PLATFORM (lsb_release -d):
FEATURE_REGEXP: Yes
GSSAPI Kerberos 5 support: No
FEATURE_DEBUG (debug build, slow code): No
32bit Atomic operations supported: Yes
64bit Atomic operations supported: Yes
memory allocator: system default
Runtime Instrumentation (slow code): No
uuid support: Yes
systemd support: No
Config file: /etc/rsyslog.conf
PID file: /var/run/rsyslogd.pid
Number of Bits in RainerScript integers: 64
See https://www.rsyslog.com for more information.
여기 내 rsyslog.conf가 있습니다.
~# cat /etc/rsyslog.conf
# /etc/rsyslog.conf Configuration file for rsyslog.
#
# For more information see
# /usr/share/doc/rsyslog-doc/html/rsyslog_conf.html
#################
#### MODULES ####
#################
module(load="imuxsock") # provides support for local system logging
module(load="imklog") # provides kernel logging support
#module(load="immark") # provides --MARK-- message capability
# provides UDP syslog reception
#module(load="imudp")
#input(type="imudp" port="514")
# provides TCP syslog reception
#module(load="imtcp")
#input(type="imtcp" port="514")
###########################
#### GLOBAL DIRECTIVES ####
###########################
#
# Use traditional timestamp format.
# To enable high precision timestamps, comment out the following line.
#
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
#
# Set the default permissions for all log files.
#
$FileOwner root
$FileGroup adm
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022
#
# Where to place spool and state files
#
$WorkDirectory /var/spool/rsyslog
#
# Include all config files in /etc/rsyslog.d/
#
$IncludeConfig /etc/rsyslog.d/*.conf
###############
#### RULES ####
###############
#
# First some standard log files. Log by facility.
#
auth,authpriv.* /var/log/auth.log
*.*;auth,authpriv.none -/var/log/syslog
#cron.* /var/log/cron.log
daemon.* -/var/log/daemon.log
kern.* -/var/log/kern.log
lpr.* -/var/log/lpr.log
mail.* -/var/log/mail.log
user.* -/var/log/user.log
#
# Logging for the mail system. Split it up so that
# it is easy to write scripts to parse these files.
#
mail.info -/var/log/mail.info
mail.warn -/var/log/mail.warn
mail.err /var/log/mail.err
#
# Some "catch-all" log files.
#
*.=debug;\
auth,authpriv.none;\
news.none;mail.none -/var/log/debug
*.=info;*.=notice;*.=warn;\
auth,authpriv.none;\
cron,daemon.none;\
mail,news.none -/var/log/messages
#
# Emergencies are sent to everybody logged in.
#
*.emerg :omusrmsg:*
마지막으로 systemd 서비스(/lib/systemd/system/rsyslog.service에 대한 소프트 링크)
~# cat /etc/systemd/system/syslog.service
[Unit]
Description=System Logging Service
Requires=syslog.socket
Documentation=man:rsyslogd(8)
Documentation=man:rsyslog.conf(5)
Documentation=https://www.rsyslog.com/doc/
[Service]
Type=notify
ExecStart=/usr/sbin/rsyslogd -n
StandardOutput=null
Restart=on-failure
# Increase the default a bit in order to allow many simultaneous
# files to be monitored, we might need a lot of fds.
#LimitNOFILE=16384
[Install]
WantedBy=multi-user.target
Alias=syslog.service
내가 달릴 때 /usr/sbin/rsyslogd -n나는 점점
~# /usr/sbin/rsyslogd -n
rsyslogd: pidfile '/var/run/rsyslogd.pid' and pid 6260 already exist.
If you want to run multiple instances of rsyslog, you need to specify
different pid files for them (-i option).
rsyslogd: run failed with error -3000 (see rsyslog.h or try https://www.rsyslog.com/e/3000 to learn what that number means)
서비스 상태는 다음과 같습니다.
~# systemctl status rsyslog.service
● rsyslog.service - System Logging Service
Loaded: loaded (/lib/systemd/system/rsyslog.service; enabled; vendor preset: enabled)
Active: failed (Result: exit-code) since Thu 2022-12-22 08:05:56 CET; 8s ago
Docs: man:rsyslogd(8)
man:rsyslog.conf(5)
https://www.rsyslog.com/doc/
Process: 6464 ExecStart=/usr/sbin/rsyslogd -n (code=exited, status=1/FAILURE)
Main PID: 6464 (code=exited, status=1/FAILURE)
Dec 22 08:05:56 TW-3CXNFA-B systemd[1]: rsyslog.service: Main process exited, code=exited, status=1/FAILURE
Dec 22 08:05:56 TW-3CXNFA-B systemd[1]: rsyslog.service: Failed with result 'exit-code'.
Dec 22 08:05:56 TW-3CXNFA-B systemd[1]: Failed to start System Logging Service.
Dec 22 08:05:56 TW-3CXNFA-B systemd[1]: rsyslog.service: Service RestartSec=100ms expired, scheduling restart.
Dec 22 08:05:56 TW-3CXNFA-B systemd[1]: rsyslog.service: Scheduled restart job, restart counter is at 5.
Dec 22 08:05:56 TW-3CXNFA-B systemd[1]: Stopped System Logging Service.
Dec 22 08:05:56 TW-3CXNFA-B systemd[1]: rsyslog.service: Start request repeated too quickly.
Dec 22 08:05:56 TW-3CXNFA-B systemd[1]: rsyslog.service: Failed with result 'exit-code'.
Dec 22 08:05:56 TW-3CXNFA-B systemd[1]: Failed to start System Logging Service.
나는 여기에 약간 붙어 있습니다 ... 나는 "pid가 이미 존재합니다"라는 메시지와 다른 많은 메시지를 검색했지만 아무데도 가지 못했습니다 :(
여기에 약간의 조언을 부탁드립니다. 내가 무엇을 해야 할지 아시나요?
----------- 편집하다 ------------
선배님들의 조언대로 시도해 봤습니다...
(r)syslog.service를 편집하고 -iNONE을 매개변수로 추가했습니다.
~# cat /etc/systemd/system/syslog.service
[Unit]
Description=System Logging Service
Requires=syslog.socket
Documentation=man:rsyslogd(8)
Documentation=man:rsyslog.conf(5)
Documentation=https://www.rsyslog.com/doc/
[Service]
Type=notify
ExecStart=/usr/sbin/rsyslogd -n -iNONE
StandardOutput=null
Restart=on-failure
#Increase the default a bit in order to allow many simultaneous
#files to be monitored, we might need a lot of fds.
#LimitNOFILE=16384
[Install]
WantedBy=multi-user.target
Alias=syslog.service
데몬을 다시 로드했습니다 -> systemctl daemon-reload(오류 메시지 없음)
둘 다 멈췄다systemctl stop syslog.socket rsyslog.service
둘 다 상태를 확인했어요
~# systemctl status syslog.socket rsyslog.service
● syslog.socket - Syslog Socket
Loaded: loaded (/lib/systemd/system/syslog.socket; static; vendor preset: disabled)
Active: inactive (dead) since Thu 2022-12-22 14:57:32 CET; 18s ago
Docs: man:systemd.special(7)
https://www.freedesktop.org/wiki/Software/systemd/syslog
Listen: /run/systemd/journal/syslog (Datagram)
Dec 22 10:17:58 TW-3CXNFA-B systemd[1]: Listening on Syslog Socket.
Dec 22 14:57:32 TW-3CXNFA-B systemd[1]: syslog.socket: Succeeded.
Dec 22 14:57:32 TW-3CXNFA-B systemd[1]: Closed Syslog Socket.
● rsyslog.service - System Logging Service
Loaded: loaded (/lib/systemd/system/rsyslog.service; enabled; vendor preset: enabled)
Active: inactive (dead) since Thu 2022-12-22 14:57:32 CET; 18s ago
Docs: man:rsyslogd(8)
man:rsyslog.conf(5)
https://www.rsyslog.com/doc/
Process: 22681 ExecStart=/usr/sbin/rsyslogd -n -iNONE (code=exited, status=0/SUCCESS)
Main PID: 22681 (code=exited, status=0/SUCCESS)
Dec 22 14:56:59 TW-3CXNFA-B systemd[1]: Starting System Logging Service...
Dec 22 14:57:32 TW-3CXNFA-B systemd[1]: rsyslog.service: Succeeded.
Dec 22 14:57:32 TW-3CXNFA-B systemd[1]: Stopped System Logging Service.
둘 다 비활성 상태입니다. 그런 다음 활성 PID가 있는지 확인했습니다(모두 양호).
~# ps axu | grep rsyslog
root 22747 0.0 0.0 6072 888 pts/0 S+ 14:59 0:00 grep rsyslog
pid 파일이 있는지 확인함 ls /var/run/ | grep syslog(없음)
그런 다음 서비스를 시작했는데 시간 초과 메시지가 표시되었습니다.
~# systemctl start rsyslog
Job for rsyslog.service failed because a timeout was exceeded.
See "systemctl status rsyslog.service" and "journalctl -xe" for details.
상태 확인 중
~# systemctl status rsyslog.service
● rsyslog.service - System Logging Service
Loaded: loaded (/lib/systemd/system/rsyslog.service; enabled; vendor preset: enabled)
Active: activating (start) since Thu 2022-12-22 15:03:16 CET; 1min 26s ago
Docs: man:rsyslogd(8)
man:rsyslog.conf(5)
https://www.rsyslog.com/doc/
Main PID: 22896 (rsyslogd)
Tasks: 4 (limit: 1136)
Memory: 824.0K
CGroup: /system.slice/rsyslog.service
└─22896 /usr/sbin/rsyslogd -n -iNONE
Dec 22 15:03:16 TW-3CXNFA-B systemd[1]: Starting System Logging Service...
플러스 저널:
~# journalctl -xe
-- A stop job for unit rsyslog.service has finished.
--
-- The job identifier is 25478 and the job result is done.
Dec 22 15:03:16 TW-3CXNFA-B systemd[1]: Starting System Logging Service...
-- Subject: A start job for unit rsyslog.service has begun execution
-- Defined-By: systemd
-- Support: https://www.debian.org/support
--
-- A start job for unit rsyslog.service has begun execution.
--
-- The job identifier is 25478.
Dec 22 15:04:46 TW-3CXNFA-B systemd[1]: rsyslog.service: Start operation timed out. Terminating.
Dec 22 15:04:46 TW-3CXNFA-B systemd[1]: rsyslog.service: Failed with result 'timeout'.
-- Subject: Unit failed
-- Defined-By: systemd
-- Support: https://www.debian.org/support
--
-- The unit rsyslog.service has entered the 'failed' state with result 'timeout'.
Dec 22 15:04:46 TW-3CXNFA-B systemd[1]: Failed to start System Logging Service.
-- Subject: A start job for unit rsyslog.service has failed
-- Defined-By: systemd
-- Support: https://www.debian.org/support
--
-- A start job for unit rsyslog.service has finished with a failure.
--
-- The job identifier is 25478 and the job result is failed.
Dec 22 15:04:46 TW-3CXNFA-B systemd[1]: rsyslog.service: Service RestartSec=100ms expired, scheduling restart.
Dec 22 15:04:46 TW-3CXNFA-B systemd[1]: rsyslog.service: Scheduled restart job, restart counter is at 2.
-- Subject: Automatic restarting of a unit has been scheduled
-- Defined-By: systemd
-- Support: https://www.debian.org/support
--
-- Automatic restarting of the unit rsyslog.service has been scheduled, as the result for
-- the configured Restart= setting for the unit.
Dec 22 15:04:46 TW-3CXNFA-B systemd[1]: Stopped System Logging Service.
-- Subject: A stop job for unit rsyslog.service has finished
-- Defined-By: systemd
-- Support: https://www.debian.org/support
--
-- A stop job for unit rsyslog.service has finished.
--
-- The job identifier is 25554 and the job result is done.
Dec 22 15:04:46 TW-3CXNFA-B systemd[1]: Starting System Logging Service...
-- Subject: A start job for unit rsyslog.service has begun execution
-- Defined-By: systemd
-- Support: https://www.debian.org/support
--
-- A start job for unit rsyslog.service has begun execution.
--
-- The job identifier is 25554.
Dec 22 15:05:01 TW-3CXNFA-B CRON[22955]: pam_unix(cron:session): session opened for user root by (uid=0)
Dec 22 15:05:01 TW-3CXNFA-B CRON[22956]: (root) CMD (command -v debian-sa1 > /dev/null && debian-sa1 1 1)
Dec 22 15:05:01 TW-3CXNFA-B CRON[22955]: pam_unix(cron:session): session closed for user root
내가 뭘 놓치고 있는 걸까?
답변1
rsyslog의 기본 PID 파일 위치는 /var/run/rsyslogd.pid다음과 같습니다( 참조 man rsyslogd). cat그 파일 안에 무엇이 있는지 알 수 있습니다.
rsyslogd해당 PID가 실제로 ( ps axu | grep $(cat /var/run/rsyslogd.pid)및 와 같은 것) 인지 확인하십시오 ps axu | grep rsyslogd. 실행 중인 경우 제안된 대로 종료하고 PID 파일을 제거합니다. 서비스 관리자가 서비스가 실행 중이 아닌데(예: 중지에 실패했다고) 생각하는 문제입니다.
PID가 존재하지만 그렇지 않은 경우 rsyslogdPID를 종료하지 마십시오. 그것은 아마도 관련이 없으며 그 행동은 유익보다는 해를 끼칠 가능성이 높습니다. rsyslog PID 파일을 제거하기만 하면 됩니다. 이는 rsyslog가 파일을 생성하고 해당 PID를 여기에 넣은 다음 중지했기 때문에 발생할 수 있으며 시스템은 나중에 해당 PID를 다른 용도로 재사용했습니다.
이제 서비스가 끝나면분명히 달리고 있지 않아그리고오해의 소지가 있는 PID 파일이 없습니다., 서비스 관리자를 사용하여 다시 시작해 보세요. 시작 /var/log/daemon.log및 기타 로그 파일( messages, syslog)을 관찰하고 시작 중 오류가 있는지 확인하세요.
흥미로운 점은 Debian 11 이후로 다음과 같이 구성되어 있다는 것입니다.~ 아니다PID 파일을 작성합니다(시작은 다음과 같습니다 /usr/sbin/rsyslogd -n -iNONE).
답변2
아래 링크를 통해 보고된 버그인 것 같습니다.
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=815862
rsyslog.service이는 직관적이지 않은 것처럼 보이지만 실제로 수행해야 할 단계는 rsyslog의 PID를 종료하거나 종료하는 것이 아니라 두 개의 시스템 장치를 중지해야 한다는 것입니다 .
systemctl stop syslog.socket rsyslog.service