/var/log/messages not updating on cpanel server

[Priyanka]

Could you please assist me in resolving the below issue?

/var/log/messages not updating on cpanel server

[Mandeep]

Hello Priyanka,

First, you will need to check if rsyslog service is running on it. You can check the same using command.

[root@nda logrotate.d]# service rsyslog status
Redirecting to /bin/systemctl status rsyslog.service
* rsyslog.service - System Logging Service
   Loaded: loaded (/usr/lib/systemd/system/rsyslog.service; enabled; vendor preset: enabled)
   Active: active (running) since Sun 2018-03-04 14:26:13 AEST; 21s ago
     Docs: man:rsyslogd(8)
           http://www.rsyslog.com/doc/
 Main PID: 12501 (rsyslogd)
   CGroup: /system.slice/rsyslog.service
           `-12501 /usr/sbin/rsyslogd -n

Mar 04 13:14:49 nda systemd[1]: Stopped System Logging Service.
Mar 04 14:26:13 nda systemd[1]: Starting System Logging Service...
Mar 04 14:26:13 nda rsyslogd[12501]:  [origin software="rsyslogd" swVersion="8.24.0" x-pid="12501" x-info="http://www.rsyslog.com"] start
Mar 04 14:26:13 nda systemd[1]: Started System Logging Service.

If it is not running then restart the service and check /var/log/messages.

[root@nda logrotate.d]# service rsyslog restart

Even after restarting the service if you notice that your issue is not resolved then you will have to perform below-listed actions on the server.

Modify /etc/rsyslog.conf with your favorite editor either vi or nano

[root@nda log]# nano /etc/rsyslog.conf

Comment out the lines of code as mentioned.

[root@nda logrotate.d]# cat /etc/rsyslog.conf | grep '$ModLoad imjournal'
#$ModLoad imjournal # provides access to the systemd journal

[root@nda logrotate.d]# cat /etc/rsyslog.conf | grep '$IMJournalStateFile'
#$IMJournalStateFile imjournal.state

As well as, change $OmitLocalLogging from on to off

[root@nda logrotate.d]# cat /etc/rsyslog.conf | grep '$OmitLocalLogging'
$OmitLocalLogging off

Try restarting the rsyslog service.

[root@nda log]# service rsyslog restart
Redirecting to /bin/systemctl restart rsyslog.service

This should fix the issue.

[root@nda log]# tail -f /var/log/messages
Mar  4 14:29:26 nda rsyslogd:  [origin software="rsyslogd" swVersion="8.24.0" x-pid="12919" x-info="http://www.rsyslog.com"] start
Mar  4 14:29:26 nda systemd[1]: Started System Logging Service.