我试图配置 rsyslog 以将日志从特定文件转发到 syslogserver，但最终我清除了整个配置（rsyslog 服务卡住了 - 无法启动）..
所以我清除了所有内容，然后再次从头开始安装所有内容...现在当我尝试启动它时它失败了。
这是操作系统版本：
~# cat /etc/os-release
PRETTY_NAME="Debian GNU/Linux 10 (buster)"
NAME="Debian GNU/Linux"
VERSION_ID="10"
VERSION="10 (buster)"
VERSION_CODENAME=buster
ID=debian
HOME_URL="https://www.debian.org/"
SUPPORT_URL="https://www.debian.org/support"
BUG_REPORT_URL="https://bugs.debian.org/"
这是 rsyslog 版本
~# rsyslogd -v
rsyslogd 8.2212.0 (aka 2022.12) compiled with:
PLATFORM: x86_64-pc-linux-gnu
PLATFORM (lsb_release -d):
FEATURE_REGEXP: Yes
GSSAPI Kerberos 5 support: No
FEATURE_DEBUG (debug build, slow code): No
32bit Atomic operations supported: Yes
64bit Atomic operations supported: Yes
memory allocator: system default
Runtime Instrumentation (slow code): No
uuid support: Yes
systemd support: No
Config file: /etc/rsyslog.conf
PID file: /var/run/rsyslogd.pid
Number of Bits in RainerScript integers: 64
See https://www.rsyslog.com for more information.
这是我的 rsyslog.conf
~# cat /etc/rsyslog.conf
# /etc/rsyslog.conf Configuration file for rsyslog.
#
# For more information see
# /usr/share/doc/rsyslog-doc/html/rsyslog_conf.html
#################
#### MODULES ####
#################
module(load="imuxsock") # provides support for local system logging
module(load="imklog") # provides kernel logging support
#module(load="immark") # provides --MARK-- message capability
# provides UDP syslog reception
#module(load="imudp")
#input(type="imudp" port="514")
# provides TCP syslog reception
#module(load="imtcp")
#input(type="imtcp" port="514")
###########################
#### GLOBAL DIRECTIVES ####
###########################
#
# Use traditional timestamp format.
# To enable high precision timestamps, comment out the following line.
#
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
#
# Set the default permissions for all log files.
#
$FileOwner root
$FileGroup adm
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022
#
# Where to place spool and state files
#
$WorkDirectory /var/spool/rsyslog
#
# Include all config files in /etc/rsyslog.d/
#
$IncludeConfig /etc/rsyslog.d/*.conf
###############
#### RULES ####
###############
#
# First some standard log files. Log by facility.
#
auth,authpriv.* /var/log/auth.log
*.*;auth,authpriv.none -/var/log/syslog
#cron.* /var/log/cron.log
daemon.* -/var/log/daemon.log
kern.* -/var/log/kern.log
lpr.* -/var/log/lpr.log
mail.* -/var/log/mail.log
user.* -/var/log/user.log
#
# Logging for the mail system. Split it up so that
# it is easy to write scripts to parse these files.
#
mail.info -/var/log/mail.info
mail.warn -/var/log/mail.warn
mail.err /var/log/mail.err
#
# Some "catch-all" log files.
#
*.=debug;\
auth,authpriv.none;\
news.none;mail.none -/var/log/debug
*.=info;*.=notice;*.=warn;\
auth,authpriv.none;\
cron,daemon.none;\
mail,news.none -/var/log/messages
#
# Emergencies are sent to everybody logged in.
#
*.emerg :omusrmsg:*
最后是 systemd 服务（它是 /lib/systemd/system/rsyslog.service 的软链接）
~# cat /etc/systemd/system/syslog.service
[Unit]
Description=System Logging Service
Requires=syslog.socket
Documentation=man:rsyslogd(8)
Documentation=man:rsyslog.conf(5)
Documentation=https://www.rsyslog.com/doc/
[Service]
Type=notify
ExecStart=/usr/sbin/rsyslogd -n
StandardOutput=null
Restart=on-failure
# Increase the default a bit in order to allow many simultaneous
# files to be monitored, we might need a lot of fds.
#LimitNOFILE=16384
[Install]
WantedBy=multi-user.target
Alias=syslog.service
当我跑步时，/usr/sbin/rsyslogd -n我
~# /usr/sbin/rsyslogd -n
rsyslogd: pidfile '/var/run/rsyslogd.pid' and pid 6260 already exist.
If you want to run multiple instances of rsyslog, you need to specify
different pid files for them (-i option).
rsyslogd: run failed with error -3000 (see rsyslog.h or try https://www.rsyslog.com/e/3000 to learn what that number means)
服务状态显示：
~# systemctl status rsyslog.service
● rsyslog.service - System Logging Service
Loaded: loaded (/lib/systemd/system/rsyslog.service; enabled; vendor preset: enabled)
Active: failed (Result: exit-code) since Thu 2022-12-22 08:05:56 CET; 8s ago
Docs: man:rsyslogd(8)
man:rsyslog.conf(5)
https://www.rsyslog.com/doc/
Process: 6464 ExecStart=/usr/sbin/rsyslogd -n (code=exited, status=1/FAILURE)
Main PID: 6464 (code=exited, status=1/FAILURE)
Dec 22 08:05:56 TW-3CXNFA-B systemd[1]: rsyslog.service: Main process exited, code=exited, status=1/FAILURE
Dec 22 08:05:56 TW-3CXNFA-B systemd[1]: rsyslog.service: Failed with result 'exit-code'.
Dec 22 08:05:56 TW-3CXNFA-B systemd[1]: Failed to start System Logging Service.
Dec 22 08:05:56 TW-3CXNFA-B systemd[1]: rsyslog.service: Service RestartSec=100ms expired, scheduling restart.
Dec 22 08:05:56 TW-3CXNFA-B systemd[1]: rsyslog.service: Scheduled restart job, restart counter is at 5.
Dec 22 08:05:56 TW-3CXNFA-B systemd[1]: Stopped System Logging Service.
Dec 22 08:05:56 TW-3CXNFA-B systemd[1]: rsyslog.service: Start request repeated too quickly.
Dec 22 08:05:56 TW-3CXNFA-B systemd[1]: rsyslog.service: Failed with result 'exit-code'.
Dec 22 08:05:56 TW-3CXNFA-B systemd[1]: Failed to start System Logging Service.
我在这里有点卡住了...我用谷歌搜索了“pid 已经存在”消息和许多其他消息，但毫无结果 :(
我将非常感激您的推动 :( 您知道我需要做什么吗？
- - - - - - 编辑 - - - - - -
我按照你们的提示尝试了这个......
编辑 (r)syslog.service 并添加 -iNONE 作为参数
~# cat /etc/systemd/system/syslog.service
[Unit]
Description=System Logging Service
Requires=syslog.socket
Documentation=man:rsyslogd(8)
Documentation=man:rsyslog.conf(5)
Documentation=https://www.rsyslog.com/doc/
[Service]
Type=notify
ExecStart=/usr/sbin/rsyslogd -n -iNONE
StandardOutput=null
Restart=on-failure
#Increase the default a bit in order to allow many simultaneous
#files to be monitored, we might need a lot of fds.
#LimitNOFILE=16384
[Install]
WantedBy=multi-user.target
Alias=syslog.service
重新加载守护进程 -> systemctl daemon-reload（无错误消息）
停止了systemctl stop syslog.socket rsyslog.service
检查了两者的状态
~# systemctl status syslog.socket rsyslog.service
● syslog.socket - Syslog Socket
Loaded: loaded (/lib/systemd/system/syslog.socket; static; vendor preset: disabled)
Active: inactive (dead) since Thu 2022-12-22 14:57:32 CET; 18s ago
Docs: man:systemd.special(7)
https://www.freedesktop.org/wiki/Software/systemd/syslog
Listen: /run/systemd/journal/syslog (Datagram)
Dec 22 10:17:58 TW-3CXNFA-B systemd[1]: Listening on Syslog Socket.
Dec 22 14:57:32 TW-3CXNFA-B systemd[1]: syslog.socket: Succeeded.
Dec 22 14:57:32 TW-3CXNFA-B systemd[1]: Closed Syslog Socket.
● rsyslog.service - System Logging Service
Loaded: loaded (/lib/systemd/system/rsyslog.service; enabled; vendor preset: enabled)
Active: inactive (dead) since Thu 2022-12-22 14:57:32 CET; 18s ago
Docs: man:rsyslogd(8)
man:rsyslog.conf(5)
https://www.rsyslog.com/doc/
Process: 22681 ExecStart=/usr/sbin/rsyslogd -n -iNONE (code=exited, status=0/SUCCESS)
Main PID: 22681 (code=exited, status=0/SUCCESS)
Dec 22 14:56:59 TW-3CXNFA-B systemd[1]: Starting System Logging Service...
Dec 22 14:57:32 TW-3CXNFA-B systemd[1]: rsyslog.service: Succeeded.
Dec 22 14:57:32 TW-3CXNFA-B systemd[1]: Stopped System Logging Service.
两者都处于非活动状态。然后我检查是否有任何活动的 PID（全部良好）
~# ps axu | grep rsyslog
root 22747 0.0 0.0 6072 888 pts/0 S+ 14:59 0:00 grep rsyslog
验证是否存在 pid 文件ls /var/run/ | grep syslog(无)
然后我启动了该服务，结果出现了超时消息
~# systemctl start rsyslog
Job for rsyslog.service failed because a timeout was exceeded.
See "systemctl status rsyslog.service" and "journalctl -xe" for details.
检查状态
~# systemctl status rsyslog.service
● rsyslog.service - System Logging Service
Loaded: loaded (/lib/systemd/system/rsyslog.service; enabled; vendor preset: enabled)
Active: activating (start) since Thu 2022-12-22 15:03:16 CET; 1min 26s ago
Docs: man:rsyslogd(8)
man:rsyslog.conf(5)
https://www.rsyslog.com/doc/
Main PID: 22896 (rsyslogd)
Tasks: 4 (limit: 1136)
Memory: 824.0K
CGroup: /system.slice/rsyslog.service
└─22896 /usr/sbin/rsyslogd -n -iNONE
Dec 22 15:03:16 TW-3CXNFA-B systemd[1]: Starting System Logging Service...
加上日记：
~# journalctl -xe
-- A stop job for unit rsyslog.service has finished.
--
-- The job identifier is 25478 and the job result is done.
Dec 22 15:03:16 TW-3CXNFA-B systemd[1]: Starting System Logging Service...
-- Subject: A start job for unit rsyslog.service has begun execution
-- Defined-By: systemd
-- Support: https://www.debian.org/support
--
-- A start job for unit rsyslog.service has begun execution.
--
-- The job identifier is 25478.
Dec 22 15:04:46 TW-3CXNFA-B systemd[1]: rsyslog.service: Start operation timed out. Terminating.
Dec 22 15:04:46 TW-3CXNFA-B systemd[1]: rsyslog.service: Failed with result 'timeout'.
-- Subject: Unit failed
-- Defined-By: systemd
-- Support: https://www.debian.org/support
--
-- The unit rsyslog.service has entered the 'failed' state with result 'timeout'.
Dec 22 15:04:46 TW-3CXNFA-B systemd[1]: Failed to start System Logging Service.
-- Subject: A start job for unit rsyslog.service has failed
-- Defined-By: systemd
-- Support: https://www.debian.org/support
--
-- A start job for unit rsyslog.service has finished with a failure.
--
-- The job identifier is 25478 and the job result is failed.
Dec 22 15:04:46 TW-3CXNFA-B systemd[1]: rsyslog.service: Service RestartSec=100ms expired, scheduling restart.
Dec 22 15:04:46 TW-3CXNFA-B systemd[1]: rsyslog.service: Scheduled restart job, restart counter is at 2.
-- Subject: Automatic restarting of a unit has been scheduled
-- Defined-By: systemd
-- Support: https://www.debian.org/support
--
-- Automatic restarting of the unit rsyslog.service has been scheduled, as the result for
-- the configured Restart= setting for the unit.
Dec 22 15:04:46 TW-3CXNFA-B systemd[1]: Stopped System Logging Service.
-- Subject: A stop job for unit rsyslog.service has finished
-- Defined-By: systemd
-- Support: https://www.debian.org/support
--
-- A stop job for unit rsyslog.service has finished.
--
-- The job identifier is 25554 and the job result is done.
Dec 22 15:04:46 TW-3CXNFA-B systemd[1]: Starting System Logging Service...
-- Subject: A start job for unit rsyslog.service has begun execution
-- Defined-By: systemd
-- Support: https://www.debian.org/support
--
-- A start job for unit rsyslog.service has begun execution.
--
-- The job identifier is 25554.
Dec 22 15:05:01 TW-3CXNFA-B CRON[22955]: pam_unix(cron:session): session opened for user root by (uid=0)
Dec 22 15:05:01 TW-3CXNFA-B CRON[22956]: (root) CMD (command -v debian-sa1 > /dev/null && debian-sa1 1 1)
Dec 22 15:05:01 TW-3CXNFA-B CRON[22955]: pam_unix(cron:session): session closed for user root
我错过了什么？
答案1
rsyslog 的默认 PID 文件位置是/var/run/rsyslogd.pid（如中所述man rsyslogd）。cat查看该文件以了解里面的内容。
检查该 PID 是否确实正在运行rsyslogd（类似于ps axu | grep $(cat /var/run/rsyslogd.pid)和ps axu | grep rsyslogd）。如果它正在运行，请按照建议将其终止并删除 PID 文件。这是服务管理器认为服务未运行而实际上正在运行的问题（例如，无法停止）。
如果 PID 存在但不存在rsyslogd，请不要终止它。它可能不相关，并且该操作可能会造成伤害而不是好处。只需删除 rsyslog PID 文件。发生这种情况可能是因为 rsyslog 创建了该文件，将其 PID 放在那里然后停止，系统后来将该 PID 重新用于其他用途。
现在，当服务显然没有运行和没有误导性的 PID 文件，尝试使用服务管理器重新启动它，观察/var/log/daemon.log和其他日志文件（messages、syslog）中的启动情况并检查启动过程中是否有任何错误。
有趣的是，自 Debian 11 以来，它被配置为不是写入任意PID文件（启动类似/usr/sbin/rsyslogd -n -iNONE）。
答案2
我认为这是通过以下链接报告的错误：
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=815862
这看起来有悖常理...但实际要执行的步骤是您必须停止两个 systemd 单元，而不仅仅是停止rsyslog.service或终止 rsyslog 的 PID：
systemctl stop syslog.socket rsyslog.service