March 17, 20251 yr i have been struggling a bit recently with 7.0.1 becoming unresponsive every couple of days and then forcing a hard reset. i went to set up syslog server to make sure i can review a copy of the logs between restarts, but really struggled to get this to work. i eventually had to venture into /etc/rsyslog.conf and make edits to add the templates for flash and remote. after doing that the first time i went back to syslog server settings (via unraid UI) and touched/saved settings, and then it would overwrite /etc/rsyslog.conf with broken configuration. well, once i got it working i left it as is so i can try get a glimpse of what's tormenting my 7.0.1 install and while i got the logs, there was nothing of value toward solving the issue so i downgraded to 7.0.0 for now. i tested the webui again and it looks like the same issue persists. here's the output from rsyslogd -N1. root@SERVER:~# rsyslogd -N1 rsyslogd: version 8.2102.0, config validation run (level 1), master config /etc/rsyslog.conf rsyslogd: Could not find template 1 'remote' - action disabled [v8.2102.0 try https://www.rsyslog.com/e/3003 ] rsyslogd: error during parsing file /etc/rsyslog.conf, on or before line 130: errors occured in file '/etc/rsyslog.conf' around line 130 [v8.2102.0 try https://www.rsyslog.com/e/2207 ] i know how to fix it manually at this point but wanted to see if this is this a known issue or something that i have going on with my server somehow? Edited March 17, 20251 yr by JDK
March 18, 20251 yr You need to set the local server IP on the "Remote syslog server" field, then apply and see if the error goes away.
March 18, 20251 yr Author it doesn't behave differently. here are the changes (set IP and also enabled mirror to flash) i made and checked immediately after save. root@SERVER:~# rsyslogd -N1 rsyslogd: version 8.2102.0, config validation run (level 1), master config /etc/rsyslog.conf rsyslogd: Could not find template 1 'remote' - action disabled [v8.2102.0 try https://www.rsyslog.com/e/3003 ] rsyslogd: error during parsing file /etc/rsyslog.conf, on or before line 132: errors occured in file '/etc/rsyslog.conf' around line 132 [v8.2102.0 try https://www.rsyslog.com/e/2207 ] i have to go and add the template for remote manually and restart the process. once i have this in place, it does log to the share, but seemingly nowhere near all the events that get mirrored to flash. so i will leave flash mirroring on for now so i have a chance to catch the issue when the server crashes again. PS. this is clearly not an issue in 7.0.1; i rolled back to 7.0.0 and still have the same experience. server crash issue also not resolved by rollback as i had another crash this morning.
March 18, 20251 yr Not sure what could be causing that, it's not a general issue, does the syslog share exist and is writable?
March 19, 20251 yr Author yeah it exists and is writeable. i would have expected syslog to have a ton more information... while no idea why, syslog server is probably just messed up on my side for some reason. in the meantime i resorted to a more brutish tactic of just copying the syslog every few minutes via user scripts. a constant tail would probably be better so i will mess with that a bit still. FILENAME="/mnt/user/syslog/syslog-$(date +%s).log" cp /var/log/syslog $FILENAME server died again sine my previous post. i cannot tell what time, because even the mirror to flash didnt provide anything different form the sparse log i had in the share i set up. with that, im probably going to upgrade back to 7.0.1 if it happens again as it would be evidence that its not the version causing issues. i did run a full pass of memtest, but that came back clean.
March 19, 20251 yr Author i settled on this running as user script on array startup. definitely getting better logs this way so went ahead and upgraded back to 7.0.1 and now just to wait and see. #!/bin/bash FILENAME="/mnt/user/syslog/syslog-$(date +%s)_tail.log" tail -f -n +1 /var/log/syslog > $FILENAME i went back to these settings on syslog server until i can figure out the crashing which is a primary concern for me.
April 8, 20251 yr Author Now that i have my server running stable again, i am coming back to this and cannot figure this out. i have syslog server completely disabled at this point, but still fix common problems reports that syslog is being mirrored to flash. here's what rsyslog.conf looks like after i save the above config. # /etc/rsyslog.conf Configuration file for rsyslog. # # For more information see # /usr/doc/rsyslog-@VERSION@/html/rsyslog_conf.html $template flash, "/boot/logs/syslog.log" ################# #### MODULES #### ################# $ModLoad imuxsock # provides support for local system logging $ModLoad imklog # provides kernel logging support (previously done by rklogd) # limetech - we don't need no stinkin' MARKS #$ModLoad immark # provides --MARK-- message capability # ######### Receiving Messages from Remote Hosts ########## # TCP Syslog Server: # provides TCP syslog reception and GSS-API (if compiled to support it) #$ModLoad imtcp # load module #$InputTCPServerRun 514 # start up TCP listener at port 514 # UDP Syslog Server: # limetech - let's enable this #$ModLoad imudp # provides UDP syslog reception $UDPServerAddress 127.0.0.1 # localhost only $UDPServerRun 514 # start a UDP syslog server at standard port 514 ########################### #### GLOBAL DIRECTIVES #### ########################### # # Use traditional timestamp format. # To enable high precision timestamps, comment out the following line. # $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat # # Use traditional Slackware console log level # $klogConsoleLogLevel 3 # # Set the default permissions for all log files. # $FileOwner root $FileGroup root $FileCreateMode 0640 $DirCreateMode 0755 $Umask 0022 # # Include all config files in /etc/rsyslog.d/ $RuleSet local $RuleSet RSYSLOG_DefaultRuleset $RuleSet RSYSLOG_DefaultRuleset $RuleSet RSYSLOG_DefaultRuleset $RuleSet RSYSLOG_DefaultRuleset $RuleSet RSYSLOG_DefaultRuleset $RuleSet RSYSLOG_DefaultRuleset $RuleSet RSYSLOG_DefaultRuleset $RuleSet RSYSLOG_DefaultRuleset # limetech - ok # $IncludeConfig /etc/rsyslog.d/*.conf ############### #### RULES #### ############### # limetech - everything goes to syslog. $RuleSet RSYSLOG_DefaultRuleset *.debug -/var/log/syslog # Uncomment this to see kernel messages on the console. #kern.* /dev/console # Log anything 'info' or higher, but lower than 'warn'. # Exclude authpriv, cron, mail, and news. These are logged elsewhere. #*.info;*.!warn;\ # authpriv.none;cron.none;mail.none;news.none -/var/log/messages # Log anything 'warn' or higher. # Exclude authpriv, cron, mail, and news. These are logged elsewhere. #*.warn;\ # authpriv.none;cron.none;mail.none;news.none -/var/log/syslog # Debugging information is logged here. #*.=debug -/var/log/debug # Private authentication message logging: #authpriv.* -/var/log/secure # Cron related logs: #cron.* -/var/log/cron # Mail related logs: #mail.* -/var/log/maillog # Emergency level messages go to all users: *.emerg :omusrmsg:* # This log is for news and uucp errors: #uucp,news.crit -/var/log/spooler # Uncomment these if you'd like INN to keep logs on everything. # You won't need this if you don't run INN (the InterNetNews daemon). #news.=crit -/var/log/news/news.crit #news.=err -/var/log/news/news.err #news.notice -/var/log/news/news.notice # ########## Remote Logging (we use TCP for reliable delivery) ########## # An on-disk queue is created for this action. If the remote host is # down, messages are spooled to disk and sent when it is up again. #$WorkDirectory /rsyslog/spool # where to place spool files #$ActionQueueFileName uniqName # unique name prefix for spool files #$ActionQueueMaxDiskSpace 1g # 1gb space limit (use as much as possible) #$ActionQueueSaveOnShutdown on # save messages to disk on shutdown #$ActionQueueType LinkedList # run asynchronously #$ActionResumeRetryCount -1 # infinite retries if host is down # remote host is: name/ip:port, e.g. 192.168.0.1:514, port optional #*.* @localhost:514 $DefaultRuleset local $DefaultRuleset RSYSLOG_DefaultRuleset $DefaultRuleset RSYSLOG_DefaultRuleset $DefaultRuleset RSYSLOG_DefaultRuleset $DefaultRuleset RSYSLOG_DefaultRuleset $DefaultRuleset RSYSLOG_DefaultRuleset $DefaultRuleset RSYSLOG_DefaultRuleset $DefaultRuleset RSYSLOG_DefaultRuleset $DefaultRuleset RSYSLOG_DefaultRuleset $DefaultRuleset RSYSLOG_DefaultRuleset *.* ?flash
April 9, 20251 yr Author it is, yes. i just connected via ssh to pull a tail on that log. root@SERVER:~# tail -f /boot/logs/syslog.log Apr 9 08:13:06 SERVER root: Fix Common Problems: Warning: unraid.patch.plg Not Compatible with Unraid version 7.1.0-beta.1 Apr 9 08:13:08 SERVER sshd-session[141710]: Connection from 192.168.0.100 port 50543 on 192.168.0.5 port 22 rdomain "" Apr 9 08:13:08 SERVER sshd-session[141710]: Postponed keyboard-interactive for root from 192.168.0.100 port 50543 ssh2 [preauth] Apr 9 08:13:12 SERVER sshd-session[141710]: Postponed keyboard-interactive/pam for root from 192.168.0.100 port 50543 ssh2 [preauth] Apr 9 08:13:12 SERVER sshd-session[141710]: Accepted keyboard-interactive/pam for root from 192.168.0.100 port 50543 ssh2 Apr 9 08:13:12 SERVER sshd-session[141710]: pam_unix(sshd:session): session opened for user root(uid=0) by (uid=0) Apr 9 08:13:12 SERVER sshd-session[141710]: User child is on pid 142329 Apr 9 08:13:12 SERVER sshd-session[142329]: Starting session: shell on pts/1 for root from 192.168.0.100 port 50543 id 0 Apr 9 08:13:12 SERVER root: Fix Common Problems: Warning: Syslog mirrored to flash Apr 9 08:13:12 SERVER emhttpd: read SMART /dev/sdi
April 9, 20251 yr Author i have done that, and possibly every other combination possible on the form. result is the same. it looks like the config i posted above is some sort of a default template...is there some area where this might be configured?
April 9, 20251 yr Author thanks will try that and report back. im 88% through preclearing a new disk.
April 17, 20251 yr Author I wasn't able to come back to this right away... I deleted /boot/config/rsyslog.cfg and rebooted, but issue still shows on fix common problems. /boot/config/rsyslog.cfg was recreated but is now a blank file vs having the obvious settings before. what is responsible for writing the content of /etc/rsyslog.conf because i would guess that is the problem.
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.