rsyslog : *SYSLOG CHECK* Failed to detect check line [1XUZEO7ClhmqCSHv6eXvOwiKyZ] sent to SYSLOG

Discussion in 'ISPConfig 3 Priority Support' started by IzFazt, Apr 13, 2022.

  1. IzFazt

    IzFazt Member HowtoForge Supporter

    Working on this for some time, many lines alike in lfd.log
    rsyslog : *SYSLOG CHECK* Failed to detect check line [1XUZEO7ClhmqCSHv6eXvOwiKyZ] sent to SYSLOG

    Ubuntu 20.04.4 LTS, updated, upgraded.
    Script installation for ISPConfig.
    This system is also running pagespeed, csf and crowdsec.

    /etc/rsyslog.conf default
    /etc/systemd/journald..conf edited 2 options related to the issue according to some
    rsyslog daemon is up and running
     
  2. Jesse Norell

    Jesse Norell ISPConfig Developer Staff Member ISPConfig Developer

    LFD is the login failure daemon, it is normal for it to produce log messages. I may be missing it, but what is your actual question/issue?
     
  3. IzFazt

    IzFazt Member HowtoForge Supporter

    Hello Jesse, you're correct, the issue is LFD should not fail to detect this and many other lines. The bug is often referenced in Google but I can't find a working solution. Regards, Rick.
     
  4. Jesse Norell

    Jesse Norell ISPConfig Developer Staff Member ISPConfig Developer

    Yeah, searching a bit more, it indicates syslog failure (LFD is checking that syslog is working properly).

    What do you have in your rsyslog config (/etc/rsyslog.conf and /etc/rsyslog.d/*)? Is systemd-journald running? (systemctl list-units --all | grep journal)
     
  5. IzFazt

    IzFazt Member HowtoForge Supporter

    I checked file owners, they are ok

    root@hosting:/etc/rsyslog.d# systemctl list-units --all | grep journal

    systemd-journal-flush.service loaded active exited Flush Journal to Persistent Storage
    systemd-journald.service loaded active running Journal Service
    systemd-journald-audit.socket loaded active running Journal Audit Socket
    systemd-journald-dev-log.socket loaded active running Journal Socket (/dev/log)
    systemd-journald.socket loaded active running Journal Socket
     
    Last edited: Apr 13, 2022

Share This Page