CSF fails to detect a code in syslog ( code is present )

[tzemljak]

Hello ,
we're having multiple instances of csf installed, one of them ( server name: A30 ) reports a error:
lfd on A30: SYSLOG Check Failed
Error: Failed to detect code [hpi8op2eMzu93Rjbb6rdE4t] in SYSLOG_LOG [/var/log/syslog]
SYSLOG may not be running correctly on A30

Above mentioned file exists, csf can read/write to it.
Manual search for control string finds it:
[root@A30 ~]# cat /var/log/syslog | grep hpi8op2eMzu93Rjbb6rdE4t
<14>1 2013-08-06T22:13:26.640456+02:00 A30 lfd 1605 - - SYSLOG check [hpi8op2eMzu93Rjbb6rdE4t]

Server in question is a Centos 5.9 instance virtualised on hyper-v server 2008 (uname -a output: Linux A30 2.6.32-358.11.1.el6.x86_64 #1 SMP Wed Jun 12 03:34:52 UTC 2013 x86_64 x86_64 x86_64 GNU/Linux)

One of similar posts mentioned IOWAIT situations might trigger the behaviour, it's not the case here.

Kindly advise how to fix the issue.

[tzemljak]

-UPDATE-
Removing, purging and re-installing CSF did not help.

[zync]

Any update on this? I got a similar notice just today after. My VPS has been up for two weeks now and this is the first time I got this kind of notice via lfd.

Code: Select all

Time:  Sun Sep  8 02:36:04 2013 -0400
Error: Failed to detect code [0LwosyKEHDO5U3a5] in SYSLOG_LOG [/var/log/messages]

[tzemljak]

No change.

[zync]

Have you resolved this issue yet? My VPS provider told me

Syslog might not have been set to auto start during a reboot. (most likely cause as we did a reboot on the VPS node to fix some 0days)

My VPS services are working fine now, or so it seems.

[tzemljak]

This can't be the issue here, rsyslog starts on boot.

[postcd]

/scripts/restartsrv_rsyslogd --status
(XID vre3yg) The “rsyslog” service is down.

/scripts/restartsrv_rsyslogd --start
rsyslog started successfully.

not sure why it was down (maybe because my VPS got not enough RAM issue) and why not auto restarted