/var/log/messages not updating

Troubleshooting
1

No bug report, just ordinary troubleshooting

I have searched the existing open and closed issues
I am not too dumb to google

Required Information

  • DietPi version | cat /boot/dietpi/.version
    G_DIETPI_VERSION_CORE=9
    G_DIETPI_VERSION_SUB=0
    G_DIETPI_VERSION_RC=2
    G_GITBRANCH=‘master’
    G_GITOWNER=‘MichaIng’
  • Distro version | echo $G_DISTRO_NAME $G_RASPBIAN bookworm
  • Kernel version | uname -a
    Linux OldMan 6.1.0-17-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.69-1 (2023-12-30) x86_64 GNU/Linux
  • Architecture | dpkg --print-architecture
    amd64
  • SBC model | echo $G_HW_MODEL_NAME or (EG: RPi3)
       _,met$$$$$gg.          root@OldMan
    ,g$$$$$$$$$$$$$$$P.       -----------
  ,g$$P"     """Y$$.".        OS: Debian GNU/Linux 12 (bookworm) x86_64
 ,$$P'              `$$$.     Host: NUC9i9QNX K49242-500
',$$P       ,ggs.     `$$b:   Kernel: 6.1.0-17-amd64
`d$$'     ,$P"'   .    $$$    Uptime: 5 mins
 $$P      d$'     ,    $$P    Packages: 926 (dpkg)
 $$:      $$.   -    ,d$$'    Shell: bash 5.2.15
 $$;      Y$b._   _,d$P'      Resolution: 3840x2160
 Y$$.    `.`"Y$$$$P"'         CPU: Intel i9-9980HK (16) @ 5.000GHz
 `$$b      "-.__              Memory: 1632MiB / 31798MiB
  `Y$$
   `Y$$.
     `$$b.
       `Y$$b.
          `"Y$b._
              `"""
  • Power supply used | Whatever SFX PSU is built in to the NUC9i9QNX (500 W 80+ Gold)
  • SD card used | (EG: SanDisk ultra)
/dev/nvme0n1          /dev/ng0n1            S64DNX1T204745F      Samsung SSD 980 500GB                    1         124,34  GB / 500,11  GB    512   B +  0 B   2B4QFXO7

Additional Information (if applicable)

  • Software title | Full Logrotate and Rsyslog
  • Was the software title installed freshly or updated/migrated? No
  • Can this issue be replicated on a fresh installation of DietPi? Most likely not

Steps to reproduce

Have a look at /var/log/messages → empty (0 byte)

Expected behaviour

It should have some lines… pretty much always.

Actual behaviour

Its empty and not updating

Extra details

I recently noticed that one of my HDDs has read errors:
Journalctl showed lines like these in masses:

Jan 31 09:40:56 OldMan kernel: sd 14:0:0:0: [sdg] tag#0 FAILED Result: hostbyte=DID_ERROR driverbyte=DRIVER_OK cmd_age=0s
Jan 31 09:40:56 OldMan kernel: sd 14:0:0:0: [sdg] tag#0 CDB: Read(16) 88 00 00 00 00 01 12 a7 d8 00 00 00 08 00 00 00
Jan 31 09:40:56 OldMan kernel: I/O error, dev sdg, sector 4607956992 op 0x0:(READ) flags 0x80700 phys_seg 54 prio class 2

At the same time, i realised that /var/log/messages is a zero byte file.
How can i get this working again? Most google search results seem to be not applicable because the config files mentioned in those search results seem to not exist in dietpi (or at another location).
Permissions on that file are like this:

-rw-r----- 1 root             adm            0 31. Jan 16:58 messages

(thats 640, i believe)
And i did a reboot a few minutes ago (as you can see above).
Which info do you need to help me?

Thanks!!

2

By default DietPi is using journalctl and system logs are not written to /var/log. Did you already checked our different log options?

3

Hi, yeah. Sorry if i wasnt clear enough about that. I used dietpi-software to set my log options to “Full Logrotate and Rsyslog”.

4

DietPi logs always to the journal, despite what option you’ve chosen. The difference is just that full log saves on disk and the other option to RAM.
You can view the logs with journalctl.

5

Maybe @MichaIng can add something in addition

6

rsyslog (full logging option) clones system logs from systemd-journald, and separates them into a set of pain text log files, like kernel messages, authentication attempts, cron job/service outputs and any other system logs. /var/log/messages was used to contain a subset of those from /var/log/syslog, only non-error messages, while the latter contains everything. With Bookworm/the rsyslog version shipped with Bookworm, this changed: to de-duplicate the logs, /var/log/messages is not used anymore, but instead you can/need to get those from /var/log/syslog now. This pretty much makes sense. IMO there is zero point to see only non-error messages in a log file, as you then miss the most important things when checking the logs.

Same it btw true for /var/log/debug, which did contain all debug logs. And same for /var/log/daemon.log it seems. Here the related changelog entry: https://metadata.ftp-master.debian.org/changelogs//main/r/rsyslog/stable_changelog

  • Drop catch-all log files /var/log/{messages,debug}
    Avoid unnecessary duplication as those log messages end up in
    /var/log/syslog anyway. (Closes: #580552)
  • Stop splitting daemon facility into its own log file.
    The daemon facility is too vaguely defined to be really useful and since
    those log messages end up in /var/log/syslog anyway, stop duplicating
    them.
2 Likes
7

Thank you,

that is indeed conclusive, understandable, and makes perfect sense because i have been able to track down that i have been able to work with /var/log/messages until the 17th of January, which is roughly the time by which i upgraded to bookworm (thanks to the great upgrade script of yours).

I can perfectly live and work with that. Case solved :slight_smile:

1 Like
8

This topic was automatically closed 90 days after the last reply. New replies are no longer allowed.