rsyslog : SYSLOG CHECK Failed to detect check line [1XUZEO7ClhmqCSHv6eXvOwiKyZ] sent to SYSLOG

IzFazt · Apr 13, 2022

Working on this for some time, many lines alike in lfd.log
rsyslog : *SYSLOG CHECK* Failed to detect check line [1XUZEO7ClhmqCSHv6eXvOwiKyZ] sent to SYSLOG

Ubuntu 20.04.4 LTS, updated, upgraded.
Script installation for ISPConfig.
This system is also running pagespeed, csf and crowdsec.

/etc/rsyslog.conf default
/etc/systemd/journald..conf edited 2 options related to the issue according to some

RateLimitInterval=30s
RateLimitBurst=1000000
Click to expand...

rsyslog daemon is up and running

root@hosting:/etc/ssh# systemctl status rsyslog
● rsyslog.service - System Logging Service
Loaded: loaded (/lib/systemd/system/rsyslog.service; enabled; vendor preset: enabled)
Active: active (running) since Wed 2022-04-13 12:34:43 UTC; 2h 6min ago
TriggeredBy: ● syslog.socket
Docs: man:rsyslogd(8)
https://www.rsyslog.com/doc/
Main PID: 36120 (rsyslogd)
Tasks: 4 (limit: 38428)
Memory: 1.6M
CGroup: /system.slice/rsyslog.service
└─36120 /usr/sbin/rsyslogd -n -iNONE

Apr 13 12:34:43 hosting systemd[1]: Starting System Logging Service...
Apr 13 12:34:43 hosting systemd[1]: Started System Logging Service.
Click to expand...

Jesse Norell · Apr 13, 2022

LFD is the login failure daemon, it is normal for it to produce log messages. I may be missing it, but what is your actual question/issue?

IzFazt · Apr 13, 2022

Jesse Norell said: ↑

LFD is the login failure daemon, it is normal for it to produce log messages. I may be missing it, but what is your actual question/issue?
Click to expand...

Hello Jesse, you're correct, the issue is LFD should not fail to detect this and many other lines. The bug is often referenced in Google but I can't find a working solution. Regards, Rick.

Jesse Norell · Apr 13, 2022

Yeah, searching a bit more, it indicates syslog failure (LFD is checking that syslog is working properly).

What do you have in your rsyslog config (/etc/rsyslog.conf and /etc/rsyslog.d/*)? Is systemd-journald running? (systemctl list-units --all | grep journal)

IzFazt · Apr 13, 2022

Jesse Norell said: ↑

Yeah, searching a bit more, it indicates syslog failure (LFD is checking that syslog is working properly).

What do you have in your rsyslog config (/etc/rsyslog.conf and /etc/rsyslog.d/*)? Is systemd-journald running? (systemctl list-units --all | grep journal)
Click to expand...

I checked file owners, they are ok

root@hosting:/etc/rsyslog.d# cat 50*
# Default rules for rsyslog.
#
# For more information see rsyslog.conf(5) and /etc/rsyslog.conf

#
# First some standard log files. Log by facility.
#
auth,authpriv.* /var/log/auth.log
*.*;auth,authpriv,cron,mail.none -/var/log/syslog
cron.* /var/log/cron.log
#daemon.* -/var/log/daemon.log
kern.* -/var/log/kern.log
#lpr.* -/var/log/lpr.log
mail.* -/var/log/mail.log
mail.* -/var/log/mail.info
#user.* -/var/log/user.log

#
# Logging for the mail system. Split it up so that
# it is easy to write scripts to parse these files.
#
#mail.info -/var/log/mail.info
#mail.warn -/var/log/mail.warn
mail.err /var/log/mail.err

#
# Some "catch-all" log files.
#
#*.=debug;\
# auth,authpriv.none;\
# news.none;mail.none -/var/log/debug
#*.=info;*.=notice;*.=warn;\
# auth,authpriv.none;\
# cron,daemon.none;\
# mail,news.none -/var/log/messages

#
# Emergencies are sent to everybody logged in.
#
*.emerg musrmsg:*

#
# I like to have messages displayed on the console, but only on a virtual
# console I usually leave idle.
#
#daemon,mail.*;\
# news.=crit;news.=err;news.=notice;\
# *.=debug;*.=info;\
# *.=notice;*.=warn /dev/tty8
root@hosting:/etc/rsyslog.d#
Click to expand...

root@hosting:/etc/rsyslog.d# cat /etc/rsyslog.conf
# /etc/rsyslog.conf configuration file for rsyslog
#
# For more information install rsyslog-doc and see
# /usr/share/doc/rsyslog-doc/html/configuration/index.html
#
# Default logging rules can be found in /etc/rsyslog.d/50-default.conf

#################
#### MODULES ####
#################

module(load="imuxsock") # provides support for local system logging
#module(load="immark") # provides --MARK-- message capability

# provides UDP syslog reception
#module(load="imudp")
#input(type="imudp" port="514")

# provides TCP syslog reception
#module(load="imtcp")
#input(type="imtcp" port="514")

# provides kernel logging support and enable non-kernel klog messages
module(load="imklog" permitnonkernelfacility="on")

###########################
#### GLOBAL DIRECTIVES ####
###########################

#
# Use traditional timestamp format.
# To enable high precision timestamps, comment out the following line.
#
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

# Filter duplicated messages
$RepeatedMsgReduction on

#
# Set the default permissions for all log files.
#
$FileOwner syslog
$FileGroup adm
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022
$PrivDropToUser syslog
$PrivDropToGroup syslog

#
# Where to place spool and state files
#
$WorkDirectory /var/spool/rsyslog
#
# Include all config files in /etc/rsyslog.d/
#
$IncludeConfig /etc/rsyslog.d/*.conf
Click to expand...

root@hosting:/etc/rsyslog.d# systemctl list-units --all | grep journal

systemd-journal-flush.service loaded active exited Flush Journal to Persistent Storage
systemd-journald.service loaded active running Journal Service
systemd-journald-audit.socket loaded active running Journal Audit Socket
systemd-journald-dev-log.socket loaded active running Journal Socket (/dev/log)
systemd-journald.socket loaded active running Journal Socket

Log in or Sign up

rsyslog : SYSLOG CHECK Failed to detect check line [1XUZEO7ClhmqCSHv6eXvOwiKyZ] sent to SYSLOG

IzFazt Member

Jesse Norell Well-Known Member Staff Member Howtoforge Staff

IzFazt Member

Jesse Norell Well-Known Member Staff Member Howtoforge Staff

IzFazt Member

Share This Page

Log in or Sign up

rsyslog : *SYSLOG CHECK* Failed to detect check line [1XUZEO7ClhmqCSHv6eXvOwiKyZ] sent to SYSLOG

IzFazt Member

Jesse Norell Well-Known Member Staff Member Howtoforge Staff

IzFazt Member

Jesse Norell Well-Known Member Staff Member Howtoforge Staff

IzFazt Member

Share This Page

Useful Searches

rsyslog : SYSLOG CHECK Failed to detect check line [1XUZEO7ClhmqCSHv6eXvOwiKyZ] sent to SYSLOG