• [SOLVED] [6.9.0-beta25] through [6.9.0-RC1] Syslog Server Broken, Error in Logs.

    • Solved Minor

    Hello all,

    I was attempting to have my unraid server log to itself so that the logs persisted.

    I did the following:

    1. enabled the local syslog server
    2. set it log to a new share that I previously created
    3. enabled rotation
    4. set it to 50mb
    5. 4 files
    6. Set my remote server to my private unraid ip
    7. left the ports alone (UDP 514)
    8. Mirror to flash set to No


    When I click apply, I get an error in my System Logs that says the configuration failed to parse. Nothing gets put in the share I created.




    The error:



    Text of the error:

    Jul 19 08:03:18 XXX ool www[24597]: /usr/local/emhttp/plugins/dynamix/scripts/rsyslog_config
    Jul 19 08:03:20 XXX rsyslogd:  Could not find template 1 'remote' - action disabled [v8.2002.0 try https://www.rsyslog.com/e/3003 ]
    Jul 19 08:03:20 XXX rsyslogd: error during parsing file /etc/rsyslog.conf, on or before line 121: errors occured in file '/etc/rsyslog.conf' around line 121 [v8.2002.0 try https://www.rsyslog.com/e/2207 ]
    Jul 19 08:03:20 XXX rsyslogd: [origin software="rsyslogd" swVersion="8.2002.0" x-pid="26836" x-info="https://www.rsyslog.com"] start



    User Feedback

    Recommended Comments

    Hum, I haven't upgraded to RC1 because I use telegraf / smartctl to monitor the system and hate the idea of having all my disks spun up 24/7, so I couldn't re-test this feature.


    But it does look like the very same error messages we've been reporting since August, so I understand we should have read "fixed in next release" as "fixed in a future release coming soon™". Just a matter of terminology.


    Let's be fair however, the release notes state : rsyslog: fix broken "Mirror syslog to flash"

    What @nblom tried to setup is much smarter than writing syslogs to the flash drive : enable local syslog server, setup to write on a local share, and self-point the server to this "remote" syslog server. Advantages are obvious, there are no potential massive writes to the flash drive, and the Unraid server is available for other machines and network devices as a remote syslog server. But the "Mirror syslog to flash" is another option. Maybe this one works in RC1. Anyone tried ? Even if that works, let's be explicit, the bug should not be closed, as other options are still faulty...


    In the meantime, the only way to have persistent logs across reboots or crashes is to have another 24/7 machine as a remote syslog server. Guys, I'm a geek, but my wife still prevents me from turning the lounge into a datacenter. And I don't own my electricity company, I pay my bills...


    But I swear I will never again argue against this long lasting bug being classified as "minor". Communication is easy once you have agreed on the generally-agreed meaning of words, but I'm afraid we'll never reach that level of mutual understanding...


    PS : btw @nblom, I would suggest to amend the title of the thread to "[6.9.0-BETA25] THROUGH [6.9.0-RC1]". Who knows, it may draw minimal attention soon™

    Edited by Gnomuz
    request to OP to change thread title
    Link to comment

    According to your syslog, I would say no ! 😂


    For reference, here is my syslog in 6.9.0-beta35 with exactly the same setup as @nblom (local syslog server disabled, no remote syslog server declared, Mirror syslog to flash : Yes)

    Dec 15 17:31:45 NAS ool www[19853]: /usr/local/emhttp/plugins/dynamix/scripts/rsyslog_config
    Dec 15 17:31:47 NAS rsyslogd: invalid or yet-unknown config file command 'UDPServerAddress' - have you forgotten to load a module? [v8.2002.0 try https://www.rsyslog.com/e/3003 ]
    Dec 15 17:31:47 NAS rsyslogd: invalid or yet-unknown config file command 'UDPServerRun' - have you forgotten to load a module? [v8.2002.0 try https://www.rsyslog.com/e/3003 ]
    Dec 15 17:31:47 NAS rsyslogd: Could not find template 1 'flash' - action disabled [v8.2002.0 try https://www.rsyslog.com/e/3003 ]
    Dec 15 17:31:47 NAS rsyslogd: error during parsing file /etc/rsyslog.conf, on or before line 66: errors occured in file '/etc/rsyslog.conf' around line 66 [v8.2002.0 try https://www.rsyslog.com/e/2207 ]
    Dec 15 17:31:47 NAS rsyslogd: [origin software="rsyslogd" swVersion="8.2002.0" x-pid="20087" x-info="https://www.rsyslog.com"] start

    Quickly comparing, I would say there's undoubtedly a change between beta35 and rc1 : the number of errors in syslog jumped from 1 to 3 with the same setup. So it seems something has been tried, but I would leave the bug open at that stage if I were to decide.

    Thanks for changing the title @nblom , and let's hope it's the last time you have to do so, otherwise you'll have to automate this somehow ...

    Link to comment

    Try this:


    Delete /config/rsyslog.cfg and /config/rsyslog.conf from the flash drive then reboot (or alternatively, delete /config/rsyslog.cfg, stop the array and restart it) and set things back up again.  If it works, then kudos to @limetech for figuring it out.

    Link to comment


    I just tried deleting both files from /config and then stopping and restarting the array. This did NOT fix the issue.


    Same errors:



    Do I need to delete /etc/rsyslog.conf?


    Edit: And I also reconfigured the settings for Syslog.

    Edited by nblom
    adding that I reconfigured
    • Thanks 1
    Link to comment

    @Squid I think that worked!





    Thanks a bunch!


    Thanks also to @limetech.


    @Gnomuz we have a way of getting this to work. I am going to close this as solved and retitle as [SOLVED]. There may be more work in order to resolve any issues going from 6.8.3 to 6.9.0 (release). But I will leave that up to these guys.

    • Like 1
    Link to comment

    @Squid I think that worked!

    You had to delete two files and then reboot?  Were they config/rsyslog.cfg and /etc/rsyslog.conf?


    32 minutes ago, nblom said:

    There may be more work in order to resolve any issues going from 6.8.3 to 6.9.0 (release).

    Shouldn't be the case.  The 'bug' that got us into this mess was introduced in one of the 6.9-beta's.


    thanks for reporting and thanks to @Squid for recreating this issue and pointing me in the right direction!

    Link to comment


    Here's what I did:

    1. Deleted the two files from /boot/config:
      • rsyslog.cfg
      • rsyslog.conf
    2. Rebooted
    3. Started the Array
    4. Reconfigured the Syslog settings
      • image.thumb.png.fb49914d8a5db7fa595d1996f0c00130.png
    5. Hit Apply
    6. Checked the Syslog and saw that rsyslogd started
    7. Verified that there was a file in my share
    8. Verified that data was in the file



    • Like 2
    • Thanks 3
    Link to comment

    Thanks for the step-by-step @nblom, persistent syslog is back ! Joint efforts are finally rewarded 😉


    Maybe this procedure should be added to the release notes, as the fix seems to have no effect without it.

    I will test once next release candidate is published, as I can't afford to have all the array disks spun up 24/7 with RC1.

    Link to comment

    Same as above thanks to all involved in helping resolve, working as expected now. :)

    Edited by SuudoXR
    Link to comment

    This works for me, but I do want to note that I can't get the logs to save to the flash drive. The syslog server way works though.




    Link to comment

    Hi all,

    As a conclusion to this long-lasting thread, I've just updated to 6.9.1 and I succesfully managed to activate persistent syslog to an ad-hoc share by following @nblom's step-by-step. Without deleting the rsyslog.conf and .cfg files, and then rebooting, I still got errors and no persistent syslog.

    Edited by Gnomuz
    Link to comment

    Join the conversation

    You can post now and register later. If you have an account, sign in now to post with your account.
    Note: Your post will require moderator approval before it will be visible.

    Add a comment...

    ×   Pasted as rich text.   Restore formatting

      Only 75 emoji are allowed.

    ×   Your link has been automatically embedded.   Display as a link instead

    ×   Your previous content has been restored.   Clear editor

    ×   You cannot paste images directly. Upload or insert images from URL.

  • Status Definitions


    Open = Under consideration.


    Solved = The issue has been resolved.


    Solved version = The issue has been resolved in the indicated release version.


    Closed = Feedback or opinion better posted on our forum for discussion. Also for reports we cannot reproduce or need more information. In this case just add a comment and we will review it again.


    Retest = Please retest in latest release.

    Priority Definitions


    Minor = Something not working correctly.


    Urgent = Server crash, data loss, or other showstopper.


    Annoyance = Doesn't affect functionality but should be fixed.


    Other = Announcement or other non-issue.