Failed to detect code in SYSLOG_LOG

[melz]

Hi,

i have ubuntu 12.04. In this version the logfile messages does not work. All information is now in syslog. I think configserver syslog_check needs messages for working.

Is there a way to learn syslog_check how to do or must I do without this feature?

Thank you.

[ForumAdmin]

You probably have not set SYSLOG_LOG to point to "/var/log/syslog" which is the location of the syslog on that OS.

[melz]

Hi Forumadmin,

no that is not the mistake. I have changed all the pointers to messages to syslog. The error is: Failed to detect code [vAUIXw0xLdoamMlCStAhmygVKfnvJ] in SYSLOG_LOG [/var/log/syslog]

The code "vAUIXw0xLdoamMlCStAhmygVKfnvJ" for example I have not found in any log. Where does syslog_log send it to?

Thank you

[sneader]

I received this alert for the first time this morning. My pointer is correctly set to /var/log/messages and it's been working fine for weeks... I haven't changed anything (as far as I know). Will continue to look for solutions.

- Scott

[chirpy]

You may see the report happen on occasion (we see it on one of our VPS servers) it can happen if there are IOWAIT issues, e.g. when backups are running, and there is a delay in the log line being written by syslog and the lfd timer being tripped.

[sneader]

Thanks Chirpy... indeed I haven't seen that alert since, so it was a fluke, as you mentioned.

- Scott

[melz]

so for me there is no solution?

[SoftDux]

You may see the report happen on occasion (we see it on one of our VPS servers) it can happen if there are IOWAIT issues, e.g. when backups are running, and there is a delay in the log line being written by syslog and the lfd timer being tripped.

Hi Chripy,

What do you think would cause these errors, on a system which is not overloaded and no backups are running?

Here's a current snapshot of top:

top - 13:32:07 up 49 days, 2:35, 1 user, load average: 1.87, 1.74, 1.54
Tasks: 253 total, 1 running, 252 sleeping, 0 stopped, 0 zombie
Cpu0 : 12.3%us, 9.3%sy, 0.0%ni, 77.0%id, 0.0%wa, 0.0%hi, 1.3%si, 0.0%st
Cpu1 : 1.7%us, 5.6%sy, 0.0%ni, 92.7%id, 0.0%wa, 0.0%hi, 0.0%si, 0.0%st
Cpu2 : 3.7%us, 4.0%sy, 0.0%ni, 92.3%id, 0.0%wa, 0.0%hi, 0.0%si, 0.0%st
Cpu3 : 3.3%us, 7.0%sy, 0.0%ni, 89.7%id, 0.0%wa, 0.0%hi, 0.0%si, 0.0%st
Cpu4 : 5.3%us, 2.0%sy, 0.0%ni, 92.7%id, 0.0%wa, 0.0%hi, 0.0%si, 0.0%st
Cpu5 : 2.7%us, 4.0%sy, 0.0%ni, 93.0%id, 0.0%wa, 0.0%hi, 0.0%si, 0.3%st
Cpu6 : 5.0%us, 2.0%sy, 0.0%ni, 93.0%id, 0.0%wa, 0.0%hi, 0.0%si, 0.0%st
Cpu7 : 2.7%us, 2.0%sy, 0.0%ni, 95.3%id, 0.0%wa, 0.0%hi, 0.0%si, 0.0%st
Mem: 8388608k total, 8038340k used, 350268k free, 412744k buffers
Swap: 1048568k total, 144k used, 1048424k free, 4655100k cached

[tholler]

Hello, I answer to this older post, because I now have exactly the same problem:
Every 20 minutes I receive the following mail with this content:
----------------------
lfd on wssde.webserver-sharing.com: SYSLOG Check Failed

Time: Tue Nov 19 20:10:25 2019 +0100
Error: Failed to detect code [txny8OYLRWthHAYYc] in SYSLOG_LOG [/var/log/messages]

SYSLOG may not be running correctly on server.myserver.com
-----------------------
I made the previously suggested controls, everything is ok and until the day before yesterday everything ran without problems!

Is there now a solution besides switching off the syslog-check?

Many greetings
Thorsten