IBM Support

IBM AIX: Startup issues with rsyslogd

Question & Answer


Question

How to resolve rsyslogd failure to start

Answer

Rsyslog doesn't start either with switching script or SRC command:

No failed message output with switching script:
# syslog_ssw -r
or if the command doesn't exist, errors out with:
ksh: syslog_ssw:  not found.
Incorrect success message is put out with SRC command:
# startsrc -s syslogd
0513-059 The syslogd Subsystem has been started. Subsystem PID is 6619514.
Checking process table confirms rsyslogd process is not started
# ps -ef | grep -i rsyslogd
<no output>
Status of syslogd subsystem also shows as not active:
# lssrc -a | grep -i syslogd
syslogdswap      ras                           inoperative
syslogd          ras                           inoperative
List of things to check to resolve the issue:
1) Check the ODM entry to make sure "path" to the rsyslog daemon is set and accurate. 
# odmget -q "subsysname = 'syslogd'"  SRCsubsys
SRCsubsys:
        subsysname = "syslogd"
        synonym = ""
        cmdargs = ""
        path = "/usr/sbin/rsyslogd"
        uid = 0
        auditid = 0
        standin = "/dev/console"
        standout = "/dev/console"
        standerr = "/dev/console"
        action = 1
        multi = 1
        contact = 3
        svrkey = 0
        svrmtype = 0
        priority = 20
        signorm = 0
        sigforce = 0
        display = 1
        waittime = 20
        grpname = "ras"
If the rsyslogd binary does not exist at the path specified in the ODM entry, either copy the same level of the binary from another machine or reinstall rsyslog as per instructions at:
Verify the permissions of rsyslogd are set to:
-r-xr-xr-x    1 root     system      1305020 Nov 18 2019  /usr/sbin/rsyslogd
2) Make sure 'syslogd' subsystem "cmdargs" parameter in the ODM entry is nil. Remove any options set with:
# chssys -s syslogd -a ''    
No spaces between the single quotation marks.
If any existing "cmdargs" options are needed for "syslogd", make sure to add the options back with "chssys" command prior to starting the "syslogd".
3) If /etc/rsyslog.conf doesn't exist, create it:
# syslog_ssw -c syslog.conf rsyslog.conf
Verify correct permissions are set:
# ls -ld /etc/rsyslog.conf
-rw-r--r--    1 root     system         1313 Jan 14 13:24 /etc/rsyslog.conf
4) Check for and correct any /etc/rsyslog.conf syntax errors:
# rsyslogd -N 1

5) Verify ODM entry for syslogdswap exists, if not, either copy from some other machine and create with odmget and odmadd commands or uninstall and reinstall rsyslog.
# odmget -q "subsysname = 'syslogdswap'" SRCsubsys
SRCsubsys:
        subsysname = "syslogdswap"
        synonym = ""
        cmdargs = ""
        path = "/usr/sbin/syslogdswap"
        uid = 0
        auditid = 0
        standin = "/dev/console"
        standout = "/dev/console"
        standerr = "/dev/console"
        action = 1
        multi = 0
        contact = 3
        svrkey = 0
        svrmtype = 0
        priority = 20
        signorm = 0
        sigforce = 0
        display = 1
        waittime = 20
        grpname = "ras"
6) For manually created "syslogdswap" ODM entry with odmadd command -- like ODM entry copied from some other machine, check for any unprintable characters in the ODM entry by saving to a file and verifying with an editor.
# odmget -q "subsysname = 'syslogdswap'" SRCsubsys > syslogdswapOdmEntry
After making any needed corrections to the saved file, remove the existing ODM entry and add the saved file with corrections as a new entry:
# odmadd syslogdswapOdmEntry
Errors and Debug
=================
For errors generated when starting rsyslogd with srcmstr commands, check the console log:
# alog -t console -o > /tmp/console.log
 
Errors can also be checked with just the /usr/sbin/rsyslogd binary or with debug options:
with just the binary:
# rsyslogd
with debug options specified on the command line
# rsyslogd -dn
 
or with debug environment variables and without debug command-line options:
# export RSYSLOG_DEBUGLOG="<path>/<filename>"
# export RSYSLOG_DEBUG="Debug"
# rsyslogd

Sample error entries
==============
1) Console log entries for nonexistent /etc/rsyslog.conf
......
         0 Sun Mar 13 07:00:39 CDT 2022 rsyslogd:          0 Sun Mar 13 07:00:39 CDT 2022 could not open config file '/etc/rsyslog.conf': No such file or directory [v8.1905.0 try https://www.rsyslog.com/e/2104 ]         0 Sun Mar 13 07:00:39 CDT 2022
         0 Sun Mar 13 07:00:39 CDT 2022 rsyslogd: run failed with error  0 Sun Mar 13 07:00:39 CDT 2022 -    
........

2) /etc/rsyslog.conf syntax errors:
# rsyslogd -N 1
rsyslogd: continuing without SRC support
rsyslogd: version 8.1905.0, config validation run (level 1), master config /etc/rsyslog.conf
rsyslogd: error during parsing file /etc/rsyslog.conf, on or before line 23: warnings occurred in file '/etc/rsyslog.conf' around line 23 [v8.1905.0 try https://www.rsyslog.com/e/2207 ]
Same error output with just the binary:
# rsyslogd
rsyslogd: continuing without SRC support
rsyslogd: error during parsing file /etc/rsyslog.conf, on or before line 23: warnings occurred in file '/etc/rsyslog.conf' around line 23 [v8.1905.0 try https://www.rsyslog.com/e/2207 ]
with command-line debug options:
# rsyslogd -dn > /tmp/rsyslogd-dn.debug
Error message written to /tmp/rsyslogd-dn.debug
4224.099858000:main thread    : errmsg.c: Called LogMsg, msg: error during parsing file /etc/rsyslog.conf, on or before line 23: warnings occurred in file '/etc/rsyslog.conf' around line 23
......
3) /etc/rsyslog.conf file with no entries:
# rsyslogd
......
rsyslogd: continuing without SRC support
rsyslogd: there are no active actions configured. Inputs would run, but no output whatsoever were created. [v8.1905.0 try https://www.rsyslog.com/e/2103 ]
rsyslogd: run failed with error -2103 (see rsyslog.h or try https://www.rsyslog.com/e/2103 to learn what that number means)

[{"Type":"MASTER","Line of Business":{"code":"LOB08","label":"Cognitive Systems"},"Business Unit":{"code":"BU058","label":"IBM Infrastructure w\/TPS"},"Product":{"code":"SWG10","label":"AIX"},"ARM Category":[{"code":"a8m0z000000cvxuAAA","label":"Communication Applications-\u003ESYSLOG\/RSYSLOG"}],"ARM Case Number":"TS008986399","Platform":[{"code":"PF002","label":"AIX"}],"Version":"All Versions"}]

Document Information

Modified date:
11 December 2024

UID

ibm16573725

Page Feedback