SOLVED cannot open '/var/log/maillog' for reading: No such file or directory

Vinayak

Well-Known Member
Jun 27, 2003
288
6
168
Bharat
cPanel Access Level
Root Administrator
How come this is missing from all new servers that were setup yesterday

tail -f /var/log/maillog
tail: cannot open '/var/log/maillog' for reading: No such file or directory
tail: no files remaining


CENTOS 7.6 vzcontainer
v78.0.17
 

cPanelMichael

Administrator
Staff member
Apr 11, 2011
47,880
2,260
463
Hello @Vinayak,

Can you share the specific method you used to install cPanel & WHM? Was it installed as part of an image offered by your VPS hosting provider, or did you install it manually after provisioning a minimal instance of CentOS 7?

Thank you.
 

Vinayak

Well-Known Member
Jun 27, 2003
288
6
168
Bharat
cPanel Access Level
Root Administrator
Hello @cPanelMichael

I installed cPanel manually as instructed in your docs.

These are on OpenVZ 7 node (owned and managed by myself), CentOS 7 minimal template provided by Virtualizor.

I have now noticed that same issue is there on old OpenVZ containers, node having CentOS release 6.10, container has CENTOS 7.6 virtuozzo v78.0.17
 

cPanelMichael

Administrator
Staff member
Apr 11, 2011
47,880
2,260
463
Hello @Vinayak,

Can you submit a support ticket so we can take a closer look at an affected system? You can post the ticket number here and we'll link this thread to it.

Thank you.
 

Vinayak

Well-Known Member
Jun 27, 2003
288
6
168
Bharat
cPanel Access Level
Root Administrator
cPanel tickets ID# 11718553 was opened

Resolution

The issue appears that your minimal OS installation/template is missing rsyslog:

# ps a x u | grep syslog
root 29810 0.0 0.0 112708 976 pts/0 S+ 01:50 0:00 grep --color=auto syslog

# rpm -qa | grep syslog
#

Install and enabled the service:

# yum install rsyslog

# systemctl enable rsyslog
# systemctl start rsyslog

Check

# ps a x u | grep syslog
root 30329 77.0 0.6 765392 108240 ? Ssl 01:51 0:06 /usr/sbin/rsyslogd -n
root 30765 0.0 0.0 112708 976 pts/0 S+ 01:51 0:00 grep --color=auto syslog

And now /var/log/maillog is being populated:

# cd /var/log/
# stat maillog
File: ‘maillog’
Size: 2541357 Blocks: 4968 IO Block: 4096 regular file
Device: 98d0b6b1h/2563815089d Inode: 9660 Links: 1
Access: (0644/-rw-r--r--) Uid: ( 47/mailnull) Gid: ( 12/ mail)
Access: 2019-03-21 01:51:29.483114937 -0600
Modify: 2019-03-21 01:51:29.478115093 -0600
Change: 2019-03-21 01:51:29.478115093 -0600
Birth: -
#


Please note that cPanel does not depend on rsyslog for any sort of logging as this is the operating system's logging daemon, which is why it is not installed during the cPanel installation, even if it is missing after the OS installation. You will need to ensure this package is selected during the OS installation or installed in the VM template.

I also want to note, that a few years back there were issues with rsyslog running on OpenVZ containers causing high CPU usage, which is probably why the service was not installed into the template:

openvz rsyslog - Google Search
 

cPMarkF

*nix Technical Analyst
Staff member
Feb 4, 2013
18
8
78
cPanel Access Level
Root Administrator
The issue was that in the OpenVZ VM template, the operating system provided rsyslog package was not installed. cPanel does not rely on rsyslog for any sort of cPanel logging as rsyslog is strictly for the OS logging system, which is why it was not installed during the cPanel installation procedure, even though it was missing from the OS install.

After installing rsyslog from the OS repositories, and activating it in systemd, /var/log/maillog was created and began to populate:

Code:
yum install rsyslog
systemctl enable rsyslog
systemctl start rsyslog
Please note that in the past, rsyslog has been known to drive up CPU usage in OpenVZ containers, which is why most likely this package was not included in the VM template/OS install. If you choose to install rsyslog on your OpenVZ container, please ensure to monitor your system for any excessive CPU usage which may be attributed to the rsyslog daemon.

Edit: Should have reloaded the thread to see customer already posted the outcome of the ticket. :)