Log Files Empty

I have two FreePBX systems configured at two different locations. While troubleshooting an issue on one of these systems today, I noticed that the log files in /var/log/ are mostly empty. The specific file I am trying to view is “messages,” but it appears that most of the files are empty. Oddly, it does appear to be rotating the files (there are a bunch of versions with dates), but they are empty.

I have found a few with data.

  • sngupdate
  • boot.log
  • anaconda.log

I haven’t check all of the rest, but these at least are all empty.

  • cron
  • maillog
  • messages
  • secure
  • spooler
  • yum.log

I am running FreePBX 14, but upgraded from FreePBX 13 last fall (September 14, according to one of the few longs I have; sngupdate).

The logs on my other system are working as expected. It is also running FreePBX 14, but was upgraded much more recently.

Any thoughts on where to start looking?

Option 1: your system is working very-very good, so there are no errors / warnings logs :smiley:

Option 2: some log daemons are not running?

What does this cmd return?

systemctl -l status systemd-journald

loaded, active, and processing requests.

Try to check the rsyslog config file /etc/rsyslog.conf for the rules

Maybe try to restart the rsyslog service:

systemctl restart rsyslog

You can also try to manually add some log msg in the /var/log/messages by:

logger testing testing

And see if u have something in /var/log/messages

Also check the owner:group permissions on the log files.

I restarted the service, and suddenly the current versions of many of the log files now have entries. The entries go back to the time of the last server restart, so I suspect they were queued in memory. It also looks like it dropped a few.

I restarted the service, and suddenly the current versions of many of the log files now have entries; it looks like back to the time of the last server restart, although it looks like it did drop some newer messages.

“rsyslogd: imjournal: 2952 messages lost due to rate-limiting”

This got me suspicious that rsyslog wasn’t running automatically.

systemctl -l status rsyslog

"Loaded: loaded (/usr/lib/systemd/system/rsyslog.service; disabled; vendor preset: enabled)"

It looks like the root of the issue was that the rsyslog service was not enabled for some reason. I enabled it, so we’ll see how things go from here, but I suspect this will resolve he issue.

Thanks for the help!

1 Like

This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.