[lug] Ubuntu 14.04 LTS syslog/rsyslog Stopped Logging kern.log

[Lee Woodworth]

On 10/26/2014 05:37 PM, stimits at comcast.net wrote:
> Hi,
>  
> In the past few days I did an apt-get upgrade on an Ubuntu 14.04 LTS system which I'm trying to work on kernel modules for. Logging of all kernel messages suddenly ceased, and kern.log is now empty. If I use a printk with KERN_INFO, I can still get the output via dmesg, but am scratching my head as to where the actual log file is...I've grepped and gunzip'd and done all I can in /var/log/, and never figured out where the KERN_INFO actually goes. tail -f can no longer be used, as not even the /var/log/dmesg file contains these messages...somehow the dmesg binary command magically pulls KERN_INFO out of the air even when its specific log file does not have this information.

I suppose you have checked to see if the *syslog* dameon is running. Did something like
systemd get pulled in that wasn't there before? A reboot might also give you more
information. Does the /dev/log socket exist and is at least world readable?

It is strange that a find /etc -iname '*syslog*' wouldn't find anything.
There are other loggers, e.g. metalog. Maybe the logging system was changed
or deselected during the upgrade -- you don't actually have to have a logging
service/daemon running for a system to run.

IIRC, the kernel has an in-memory message buffer (the size is set in the kernel config
somewhere). I suspect dmesg could read from that when the /var/log/dmesg data file
doesn't exist.

HTH

>  
> So what could have happened with this apt-get upgrade? I've seen some past reports (without solution for the current situation) on syslog or rsyslog stopping logging to /var/log/kern.log, but these do not seem to be current information and have not given clues as to how configuration changed. Anyone here have ideas on what to check for current Ubuntu no longer logging to kern.log, yet showing up in dmesg program but not showing up in dmesg log files? Other than this the system seems to work fine...but it makes it a pain to work on kernel modules (FYI, there are no current changes to any modules or kernel on this system, so module development can't be a cause).
>  
> Thanks!
>  
> PS: I've looked at everything I can in /etc related to syslog and rsyslog but found nothing.
> 
> 
> 
> _______________________________________________
> Web Page:  http://lug.boulder.co.us
> Mailing List: http://lists.lug.boulder.co.us/mailman/listinfo/lug
> Join us on IRC: irc.hackingsociety.org port=6667 channel=#hackingsociety
>