[SOLVED] Problem with rsyslog

Hi,
i have web/mail server on ubuntu 14.04.5 LTS. i tried to upgrade rsyslog to last version (followed this tutorial http://www.rsyslog.com/ubuntu-repository/)

but for some reason version stay on 4.6.1

Code:

rsyslogd -v
rsyslogd 4.6.1, compiled with:
        FEATURE_REGEXP:                         Yes
        FEATURE_LARGEFILE:                      No
        FEATURE_NETZIP (message compression):   Yes
        GSSAPI Kerberos 5 support:              No
        FEATURE_DEBUG (debug build, slow code): No
        Atomic operations supported:            Yes
        Runtime Instrumentation (slow code):    No

on other server (same os) upgrade has gone ok.

some strange is on server.
when i remove rsyslog package from server (apt-get remove rsyslog) i still can run command rsyslogd -v and it show same as posted above.
on other server when i remove rsyslog package, i cannot run rsyslogd command.

And after i tried that upgrade sshd doesnt logg in /var/log/auth.log.
any sugestion?

tnx

 

Code:

 type -a rsyslog

shows which file gets executed.

Code:

dpkg --listfiles rsyslog 

shows files that came from that package. Compare those.

 

Code:

type -a rsyslog
-bash: type: rsyslog: not found

Code:

 type -a rsyslogd
rsyslogd is /usr/local/sbin/rsyslogd
rsyslogd is /usr/sbin/rsyslogd

Code:

dpkg --listfiles rsyslog
/.
/etc
/etc/default
/etc/default/rsyslog
/etc/rsyslog.d
/etc/logrotate.d
/etc/logrotate.d/rsyslog
/etc/logcheck
/etc/logcheck/ignore.d.server
/etc/logcheck/ignore.d.server/rsyslog
/etc/apparmor.d
/etc/apparmor.d/force-complain
/etc/apparmor.d/local
/etc/apparmor.d/usr.sbin.rsyslogd
/etc/apparmor.d/disable
/etc/init.d
/etc/init.d/rsyslog
/etc/init
/etc/init/dmesg.conf
/etc/init/rsyslog.conf
/etc/systemd
/etc/systemd/system
/etc/systemd/system/multi-user.target.wants
/etc/rsyslog.conf
/lib
/lib/systemd
/lib/systemd/system
/lib/systemd/system/rsyslog.service
/var
/var/spool
/var/spool/rsyslog
/usr
/usr/lib
/usr/lib/rsyslog
/usr/lib/rsyslog/lmnet.so
/usr/lib/rsyslog/imfile.so
/usr/lib/rsyslog/imklog.so
/usr/lib/rsyslog/lmnetstrms.so
/usr/lib/rsyslog/imuxsock.so
/usr/lib/rsyslog/pmciscoios.so
/usr/lib/rsyslog/lmtcpsrv.so
/usr/lib/rsyslog/lmstrmsrv.so
/usr/lib/rsyslog/lmtcpclt.so
/usr/lib/rsyslog/pmlastmsg.so
/usr/lib/rsyslog/impstats.so
/usr/lib/rsyslog/imudp.so
/usr/lib/rsyslog/immark.so
/usr/lib/rsyslog/mmexternal.so
/usr/lib/rsyslog/lmzlibw.so
/usr/lib/rsyslog/pmaixforwardedfrom.so
/usr/lib/rsyslog/lmnsd_ptcp.so
/usr/lib/rsyslog/imtcp.so
/usr/lib/rsyslog/mmpstrucdata.so
/usr/lib/rsyslog/pmcisconames.so
/usr/lib/rsyslog/pmsnare.so
/usr/lib/rsyslog/lmcry_gcry.so
/usr/lib/rsyslog/mmsequence.so
/usr/lib/rsyslog/lmregexp.so
/usr/lib/rsyslog/ommail.so
/usr/lib/rsyslog/omprog.so
/usr/lib/rsyslog/pmnull.so
/usr/sbin
/usr/sbin/rsyslogd
/usr/share
/usr/share/lintian
/usr/share/lintian/overrides
/usr/share/lintian/overrides/rsyslog
/usr/share/doc
/usr/share/doc/rsyslog
/usr/share/doc/rsyslog/changelog.Debian.gz
/usr/share/doc/rsyslog/copyright
/usr/share/doc/rsyslog/ChangeLog.gz
/usr/share/doc/rsyslog/COPYING.LESSER.gz
/usr/share/doc/rsyslog/AUTHORS
/usr/share/doc/rsyslog/README
/usr/share/doc/rsyslog/NEWS.Debian.gz
/usr/share/doc/rsyslog/README.Debian
/usr/share/doc/rsyslog/NEWS.gz
/usr/share/doc/rsyslog/COPYING.ASL20.gz
/usr/share/doc/rsyslog/COPYING.gz
/usr/share/rsyslog
/usr/share/rsyslog/50-default.conf
/usr/share/man
/usr/share/man/man1
/usr/share/man/man5
/usr/share/man/man5/rsyslog.conf.5.gz
/usr/share/man/man8
/usr/share/man/man8/rsyslogd.8.gz
/etc/systemd/system/multi-user.target.wants/rsyslog.service

Code:

which rsyslogd
/usr/local/sbin/rsyslogd

as i can see server use /usr/local/sbin/rsyslogd but that is not --listfiles rsyslog.
and also there is two rsyslogd one in local other in usr/sbin
probably this /local/sbin/rsyslogd is self compiled ? is that posible?, i cannot remember if i installed that.
if so, what is safe way to delete that.

tnx

 

The rsyslogd in /usr/local/sbin is something installed from outside Ubuntu. If it is self compiled, there may be make uninstall target in the directory where the sources are. It may have installed lots of files, like dpkg --listfiles shows for the Ubuntu package.
To stop it bothering for now, rename the executable to something else, maybe

Code:

mv /usr/local/sbin/rsyslogd /usr/local/sbin/rsyslogd-FOO

Then you can figure out how to uninstall it completely later.

 

thanks on help.
i moved that file and after that reinstall rsyslog and now version is 8.32 (last one)

problem with auth.log file was in ownership
file was owned by root:adm, and i changed that on syslog:adm and now log is update.
also some other .log file in /var/log have wrong owner so i changed them also.

Code:

sudo chown syslog:adm /var/log/auth.log

thank you one more time