How to tell if syslog.conf has a typo

configurationlogssyslog

I recently did in fact have a typo in my syslog.conf file, but I had no idea initially why I couldn't restart the daemon. In Ubuntu, all I seemed to get was a FAIL message after a rather long wait period.

Without it running properly, I was curious, is there a way I could have figured it out without scouring random logs pointlessly before considering there may have been a typo?

Edit: I really felt like using service to start/restart/etc the daemon should have given more than FAIL. Perhaps it does and I just don't know where to look, but if another service had a similar silly issue, I'd hope to be able to figure it out easily as well.

Best Answer

Probably the easiest way to do this would be to use syslogd's debug switch, -d. You can invoke syslogd manually like so.

First disable any currently running syslogd:

$ sudo service syslogd stop

Then run it manually with the following switches:

$ sudo syslogd -d -f /etc/syslog.conf

Example

I don't have a working syslogd accessible but it would be very similar to rsyslogd. Here I'm invoking rsyslogd:

 $ sudo rsyslogd -d -f /etc/rsyslog.conf
1647.845869757:7fab7df4b720: rsyslogd 4.6.3 startup, compatibility mode 0, module path ''
1647.846009627:7fab7df4b720: caller requested object 'net', not found (iRet -3003)
1647.846026890:7fab7df4b720: Requested to load module 'lmnet'
1647.846035733:7fab7df4b720: loading module '/lib64/rsyslog/lmnet.so'
1647.846155408:7fab7df4b720: module of type 2 being loaded.
1647.846167849:7fab7df4b720: source file conf.c requested reference for module 'lmnet', reference count now 1
1647.846178301:7fab7df4b720: rsyslog runtime initialized, version 4.6.3, current users 1
1647.846196912:7fab7df4b720: source file syslogd.c requested reference for module 'lmnet', reference count now 2
1647.848016526:7fab7df4b720: module of type 1 being loaded.

Testing

You can then use the command line tool logger to simulate messages of various types to syslogd. Again here I'm using rsyslogd as a stand in so the messaging will be different but the effect is still the same with either one.

  1. Sending a test message

    $ logger -t testmsg "hello world."

  2. Results

    2439.368194624:7f461fee9700: Message from UNIX socket: #3
2439.368226046:7f461fee9700: logmsg: flags 4, from 'grinchy', msg Aug 20 03:07:19 testmsg: hello world.
2439.368234458:7f461fee9700: Message has legacy syslog format.
2439.368247194:7f461fee9700: main Q: entry added, size now 1 entries
2439.368257698:7f461fee9700: wtpAdviseMaxWorkers signals busy
2439.368271525:7f461fee9700: main Q: EnqueueMsg advised worker start
2439.368283031:7f461fee9700: --------imuxsock calling select, active file descriptors (max 3): 3 
2439.368305014:7f46206ea700: main Q: entry deleted, state 0, size now 0 entries
2439.368329151:7f46206ea700: testing filter, f_pmask 127
2439.368340032:7f46206ea700: Called action, logging to builtin-file
2439.368354849:7f46206ea700: file to log to: /var/log/messages
2439.368361837:7f46206ea700: doWrite, pData->pStrm 0x7f462480a310, lenBuf 46
2439.368370439:7f46206ea700: strm 0x7f462480a310: file 5(messages) flush, buflen 46
2439.368413234:7f46206ea700: strm 0x7f462480a310: file 5 write wrote 46 bytes
2439.368424063:7f46206ea700: testing filter, f_pmask 0
2439.368431098:7f46206ea700: testing filter, f_pmask 0
2439.368437738:7f46206ea700: testing filter, f_pmask 0
2439.368444401:7f46206ea700: testing filter, f_pmask 1
2439.368450861:7f46206ea700: testing filter, f_pmask 0
2439.368457433:7f46206ea700: testing filter, f_pmask 0
2439.368464826:7f46206ea700: main Q:Reg/w0: worker IDLE, waiting for work.

  3. Log file's message

    Aug 20 03:07:12 grinchy testmsg: hello world.

Another Example

  1. Sample message

    $ logger -p daemon.warn "this is only a test."

  2. Results

    2008.317255462:7f3d13a95700: Message from UNIX socket: #3
2008.317287162:7f3d13a95700: logmsg: flags 4, from 'grinchy', msg Aug 20 03:00:08 saml: this is only a test.
2008.317295844:7f3d13a95700: Message has legacy syslog format.
2008.317307482:7f3d13a95700: main Q: entry added, size now 1 entries
2008.317317586:7f3d13a95700: wtpAdviseMaxWorkers signals busy
2008.317328948:7f3d13a95700: main Q: EnqueueMsg advised worker start
2008.317339316:7f3d13a95700: --------imuxsock calling select, active file descriptors (max 3): 3 
2008.317362187:7f3d14296700: main Q: entry deleted, state 0, size now 0 entries
2008.317375008:7f3d14296700: testing filter, f_pmask 127
2008.317386832:7f3d14296700: Called action, logging to builtin-file
2008.317401184:7f3d14296700: file to log to: /var/log/messages
2008.317409775:7f3d14296700: doWrite, pData->pStrm 0x7f3d17506310, lenBuf 51
2008.317418935:7f3d14296700: strm 0x7f3d17506310: file 5(messages) flush, buflen 51
2008.317454814:7f3d14296700: strm 0x7f3d17506310: file 5 write wrote 51 bytes
2008.317466838:7f3d14296700: testing filter, f_pmask 0
2008.317474391:7f3d14296700: testing filter, f_pmask 0
2008.317481448:7f3d14296700: testing filter, f_pmask 0
2008.317488503:7f3d14296700: testing filter, f_pmask 1
2008.317495259:7f3d14296700: testing filter, f_pmask 0
2008.317502407:7f3d14296700: testing filter, f_pmask 0
2008.317509079:7f3d14296700: main Q:Reg/w0: worker IDLE, waiting for work.

  3. This line contains our message

    2008.317287162:7f3d13a95700: logmsg: flags 4, from 'grinchy', msg Aug 20 03:00:08 saml: this is only a test.

When you're done, simply Ctrl + C to terminate it.

References

Related Question