Dear All,

I am facing an issue with my syslog server. The server is collecting remote log also. and the issue is no log messages are updated in /var/log/messages file. But other files are getting updated.

----------------------------------------------------------------------
[root@Server1 ~]# cat /etc/syslog.conf
# Log all kernel messages to the console.
# Logging much else clutters up the screen.
#kern.* /dev/console

# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;mail.none;news.none;authpriv.none;cron.none;ntpd.none /var/log/messages
#*.info;mail.none;news.none;authpriv.*;cron.none /var/log/messages

# The authpriv file has restricted access.
authpriv.* /var/log/secure

# Log all the mail messages in one place.
mail.* -/var/log/maillog


# Log cron stuff
cron.* /var/log/cron

# Everybody gets emergency messages
*.emerg *

# Save news errors of level crit and higher in a special file.
uucp,news.crit /var/log/spooler

# Save boot messages also to boot.log
local7.* /var/log/boot.log

#
# INN
#
news.=crit /var/log/news/news.crit
news.=err /var/log/news/news.err
news.notice /var/log/news/news.notice



-------------------------------------------------------------------------

[root@Server1 ~]# cat /etc/sysconfig/syslog
# Options to syslogd
# -m 0 disables 'MARK' messages.
# -r enables logging from remote machines
# -x disables DNS lookups on messages recieved with -r
# See syslogd(8) for more details
SYSLOGD_OPTIONS="-r -m 0"
# Options to klogd
# -2 prints all kernel oops messages twice; once for klogd to decode, and
# once for processing with 'ksymoops'
# -x disables all klogd processing of oops messages entirely
# See klogd(8) for more details
KLOGD_OPTIONS="-x"
#
SYSLOG_UMASK=077
# set this to a umask value to use for all log files as in umask(1).
# By default, all permissions are removed for "group" and "other".

---------------------------------------------------------------

Is any reason why the messages file does not update the logs?

What are the permissions for /var/log/messages?

Check if the command given below is creating log entries in /var/log/messages?

The permission of message file is.

------------------------------------------

[root@Server1 ~]# ll /var/log/messages
-rw-r----- 1 root root 0 Feb 13 04:03 /var/log/messages

------------------------------------------

Also there is no effect by the logger command.

I know this is an stupid answer but did you reload the syslogd daemon with the new config file?.
and after that see what happen ( try dmesg )

The syslog service is running on the server. and the "/var/log/cron", "/var/log/secure" files are updating only problem is that the /var/log/message file is not updating.

[root@CPCAPP112 ~]# ps -ef|grep syslog
root 10952 1 0 17:27 ? 00:00:01 syslogd -r -m 0

Try stopping syslog, removing and recreating /var/log/messages with touch, then either restart your computer or just simply restart syslog. Doesn't hurt to try...

I've been having a similar problem on a CentOS 5.6 box.

First time I re-booted - which fixed it.

Second time I did "service syslog restart" - which also fixed it. I didn't bother removing /var/log/messages - I just let it carry on. #logger -i "New log created for testing" now generates a line in the messages file, which it didn't before.

I'd like to know what is causing it though...

I came across the same issue just now - other log files were being written to but not syslog or messages. This was on Raspbian Wheezy.

Turns out I caused that a while back, by playing around with syslog-ng to set up a syslog server - I managed to disable all writing to syslog from the local machine.

I changed the config file at /etc/syslog-ng/syslog-ng.conf and now it's working again. I disabled the syslog server functionality and enabled the local syslog again, by commenting out:
and uncomment:
Then commenting out any log path below depending on s_net, and uncommenting log paths pointing to syslog and messages: