rsyslog check failed

[GoWilkes]

New issue today, I'm getting this email alerts every hour:

lfd on my.server.com: SYSLOG Check Failed

Time: Thu Mar 10 11:01:30 2022 -0500
Error: Failed to detect code [uAf6EKjqZ6NGNjeS] in SYSLOG_LOG [/var/log/messages]

SYSLOG may not be running correctly on my.server.com


I ran service rsyslog status and it does appear to be running.

I did a full server reboot about 26 hours ago because the server load had skyrocketed (over 50 for several hours), so I'm ignoring errors from before that. The only errors after the reboot are:

Mar 10 07:13:50 my.server.com rsyslogd[474]: imjournal: journal reloaded....]
Mar 10 07:13:53 my.server.com rsyslogd[474]: imjournal: begin to drop mes...g
Mar 10 07:13:54 my.server.com rsyslogd[474]: imjournal: 12058 messages lo...g
Mar 10 07:13:55 my.server.com rsyslogd[474]: imjournal: begin to drop mes...g

Any other ideas?

 

[cPanelWilliam]

Hey there! We've seen other reports of this error that are caused by /var/log/messages skipping or suppressing messages. Based on the log output you provided, this appears to be what is happening here.

There is a similar discussion about this in the following thread:

https://forums.cpanel.net/threads/syslog-check-failed.682337/

It appears that the test lines CSF generates in /var/log/messages are being skipped leading to the service thinking that syslog isn't working. In these cases, we suggest correcting the issue that is generating so many messages or disable the syslog check in CSF.