syslogd keeps failing

[ed.kalk]

this keeps happening:

syslogd failed @ Thu Oct 30 13:53:04 2008. A restart was attempted automagically.

this is interesting:

[email protected] [/var/log]# tail -f messages
Oct 30 15:11:05 mailserver syslogd 1.4.1: restart.
Oct 30 15:11:05 mailserver syslog: syslogd startup succeeded
Oct 30 15:11:05 mailserver kernel: klogd 1.4.1, log source = /proc/kmsg started.
Oct 30 15:11:05 mailserver kernel: Inspecting /boot/System.map-2.4.27-2trsmp
Oct 30 15:11:05 mailserver syslog: klogd startup succeeded
Oct 30 15:11:05 mailserver kernel: Loaded 19577 symbols from /boot/System.map-2.4.27-2trsmp.
Oct 30 15:11:05 mailserver kernel: Symbols match kernel version 2.4.27.
Oct 30 15:11:05 mailserver kernel: Loaded 383 symbols from 12 modules.
Oct 30 15:19:28 mailserver syslogsvcmgr: Syslog service manager called (pid:28682) (args:stop)
Oct 30 15:19:28 mailserver syslogsvcmgr: pausing...
Oct 30 15:19:43 mailserver syslogsvcmgr: resuming...
Oct 30 15:19:43 mailserver kernel: Kernel logging (proc) stopped.
Oct 30 15:19:43 mailserver kernel: Kernel log daemon terminating.
Oct 30 15:19:44 mailserver syslog: klogd shutdown succeeded
Oct 30 15:19:44 mailserver exiting on signal 15
Oct 30 15:19:59 mailserver syslogd 1.4.1: restart.
Oct 30 15:19:59 mailserver syslog: syslogd startup succeeded
Oct 30 15:19:59 mailserver kernel: klogd 1.4.1, log source = /proc/kmsg started.
Oct 30 15:19:59 mailserver kernel: Inspecting /boot/System.map-2.4.27-2trsmp
Oct 30 15:19:59 mailserver syslog: klogd startup succeeded
Oct 30 15:19:59 mailserver kernel: Loaded 19577 symbols from /boot/System.map-2.4.27-2trsmp.
Oct 30 15:19:59 mailserver kernel: Symbols match kernel version 2.4.27.
Oct 30 15:19:59 mailserver kernel: Loaded 383 symbols from 12 modules.
Oct 30 15:19:44 mailserver syslog: syslogd shutdown succeeded
Oct 30 15:19:44 mailserver syslogsvcmgr: Syslog service manager called (pid:28748) (args:start)
Oct 30 15:19:44 mailserver syslogsvcmgr: pausing...
Oct 30 15:19:59 mailserver syslogsvcmgr: resuming...

syslogd failed @ Thu Oct 30 14:19:47 2008. A restart was attempted automagically.

The time is off on syslogd by 1 hr too.. weird?

 

[mtindor]

Odd. At any rate, if you have chkservd running on that machine, restart it.

If using redhat/centos, execute this via ssh: service chkservd restart

See if that doesn't stop it from happening.

Mike

 

[ed.kalk]

Odd. At any rate, if you have chkservd running on that machine, restart it.

If using redhat/centos, execute this via ssh: service chkservd restart

See if that doesn't stop it from happening.

Mike

Thanks, I tried it and it still is doing it. thanks for the help, that's just not it.
again thanks

 

[deanstev]

Mine is doing the same....

 

[ed.kalk]

Fixed!


This message is from a Cpanel TEch:

Hello:

I FOUND IT! This is a result of the cPanel service monitor. The montior was looking for a process named syslogd run by root. In your case syslogd is run by the syslog user. I have edited /etc/chkserv.d/syslogd so that it checks for the syslog user.

This resolves this matter. If you have further questions, or would like to have this ticket closed, please let me know.

Thank you
--
John Bell, Technical Analyst 1
cPanel


I'm trying to get the lines of code from this guy and what was changed, along with what it was changed to... standby for more detail.

 

[deanstev]

ok, keep us updated...

 

[ed.kalk]

got the info from the guy

he said:

Sorry about the delay with this:

If you look at /etc/chkserv.d/syslogd:
====
[email protected] [~]# cat /etc/chkserv.d/syslogd service[syslogd]=x,x,x,/scripts/restartsrv_syslogd,syslogd,syslog
====

The last item in this comma delimited list is "syslog". This represents the user that the process will be running as when checked (as seen through the ps -ef command). Originally this was set to root.

I found that your sytem was running syslogd not as root, but as the user "syslog". Because of this, I changed "root" to "syslog" in the above line.

 

[deanstev]

Thanks!
Worked a charm!

 

[Ron Williams]

I am having the same issue except my file has the following line:

service[syslogd]=x,x,x,/scripts/restartsrv_syslogd,syslogd,root|syslogd

This is a completely new server and installation. I have received the following message ~150 times since I setup the server:

syslogd failed @ Sat Dec 27 07:28:45 2008. A restart was attempted automagically.
Service Check Method: [check command]

I have tried restarting via service chkservd restart (getting command not found) without luck. Is there a place I can look to ensure syslogd is is installed properly?

Also when looking at ps -ef syslogd is not shown.

Centos 5, WHM VPS optimized v2.

 

[Ron Williams]

Ok, so this is a pretty simple one to figure out, I just wasn't looking in the correct place. Syslog was simply not installed. Check by running rpm -q sysklogd

If nothing shows up, do the following:

I'm using centos, so in order to fix it, I simply ran yum install sysklogd and everything worked correctly after.