On the trail of the stopped rsyslog.

[Frank Murphy]

On 2\3 boxes, (F17)
rkhunter will tell me
Start Rootkit Hunter Scan ----------------------
Warning: The syslog daemon is not running.

Going by:
http://www.rsyslog.com/doc/troubleshoot.html
(needing it to be on longer to find a cause)

Tried to create a debug.log from the service file:
[Service]
EnvironmentFile=-/etc/sysconfig/rsyslog
ExecStart=/sbin/rsyslogd -n $SYSLOGD_OPTIONS -dn
> /var/log/rsyslog.log

Sockets=syslog.socket
StandardOutput=null

I'm getting a failed on 
systemctl status rsyslog.service
Process: 24737 ExecStart=/sbin/rsyslogd -n $SYSLOGD_OPTIONS -dn
> /var/log/rsyslog.debug (code=exited, status=1/FAILURE)

[Reindl Harald]

Am 03.01.2013 14:37, schrieb Frank Murphy:
> On 2\3 boxes, (F17)
> rkhunter will tell me
> Start Rootkit Hunter Scan ----------------------
> Warning: The syslog daemon is not running.
>
> Going by:
> http://www.rsyslog.com/doc/troubleshoot.html
> (needing it to be on longer to find a cause)
>
> Tried to create a debug.log from the service file:
> [Service]
> EnvironmentFile=-/etc/sysconfig/rsyslog
> ExecStart=/sbin/rsyslogd -n $SYSLOGD_OPTIONS -dn
> > /var/log/rsyslog.log
>
> Sockets=syslog.socket
> StandardOutput=null
>
> I'm getting a failed on 
> systemctl status rsyslog.service
> Process: 24737 ExecStart=/sbin/rsyslogd -n $SYSLOGD_OPTIONS -dn
> > /var/log/rsyslog.debug (code=exited, status=1/FAILURE)

rsyslog is horrible broken in context of stop the service
i made a bugreport some days ago because in my case using
rsyslog-mysql with mysqld on another host it hangs the full
90 seconds after systemd decides a force-kill at shutdown

https://bugzilla.redhat.com/show_bug.cgi?id=891137

oh and it was not really better with F16
https://bugzilla.redhat.com/show_bug.cgi?id=812617

with the systemd-unit below you do at least not need to wait
90 seconds - remember you need to "systemctl disable rsyslog.service"
before create a customized unit and "systemctl disable rsyslog.service" again
________________________________________________________________

[root@buildserver:~]$ cat /etc/systemd/system/rsyslog.service
[Unit]
Description=System Logging Service
After=network.service

[Service]
EnvironmentFile=-/etc/sysconfig/rsyslog
ExecStart=/sbin/rsyslogd -n $SYSLOGD_OPTIONS
Sockets=syslog.socket
StandardOutput=null
Restart=always
RestartSec=1
TimeoutStopSec=1

[Install]
WantedBy=multi-user.target
Alias=syslog.service