0

I'm debugging an issue where I think my server is spamming other servers because it is infected but all my logs stop in august last year, and rsyslog is missing from the system /etc/rsyslog.d still exists and clearly it was writing logs once but there are no new logs being generated for /var/log/mail.log or /var/log/messages

but running

rsyslog

results in command not found, should I run: 

apt-get install rsyslog

and then 

service rsyslog start

and has any one seen anything like this before?

Improve this question
6
  • try rsyslogd. Commented Jul 21, 2015 at 10:13
  • 1
    it says command not found and unrecognized service Commented Jul 21, 2015 at 10:23
  • which rsyslogd ? Commented Jul 21, 2015 at 10:24
  • no output is given Commented Jul 21, 2015 at 10:27
  • What is the output of ls -l /usr/sbin/rsyslogd? Commented Jul 21, 2015 at 10:54

3 Answers 3

Reset to default
1

Open the terminal and execute the command

# sudo add-apt-repository ppa:adiscon/v8-stable

Now install rsyslog

# sudo apt-get install rsyslog

to check rsyslog version,

# rsyslogd -v
rsyslogd 7.4.4, compiled with:
    FEATURE_REGEXP:             Yes
    FEATURE_LARGEFILE:          No
    GSSAPI Kerberos 5 support:      Yes
    FEATURE_DEBUG (debug build, slow code): No
    32bit Atomic operations supported:  Yes
    64bit Atomic operations supported:  Yes
    Runtime Instrumentation (slow code):    No
    uuid support:               Yes

Also check whether your rsyslog running

Improve this answer
1
  • 2
    I wouldn't suggest installing rsyslog from a PPA - that's unnecessary. If the original poster doesn't have it installed, they can reinstall from the official Ubuntu repositories. Commented Jul 21, 2015 at 15:36
1

I've re-installed it using

apt-get install rsyslog

and logs seem to be filling up again, odd that it seems to have gone missing in the first place, it's clearly been on the system before

Improve this answer
1
  • 1
    Lots of malicious attacks involve disabling logging or redirecting logs to /dev/null. Its an early step after compromising a system, in order to avoid an audible trail. You might want to be suspicious of the system on the whole IMHO. Commented Jul 21, 2015 at 17:51
1

Could be that You are running systemd.

Look in /var/log/README

You are running a systemd-based OS where traditional syslog has been
replaced with the Journal.
Improve this answer

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.