rsyslogd repeatedly prints out messages about missing dynamic directories

[Clint Byrum]

These lines from /etc/rsyslog.d/90-orchestra.conf cause problems:

$template DYNsyslog,"/var/log/orchestra/rsyslog/%$YEAR%/%$MONTH%/%$DAY%/%HOSTNAME%/syslog"

Oct 5 09:53:32 kurhah rsyslogd: Could not open dynamic file '/var/log/orchestra/rsyslog/2011/10/05/kurhah/secure' - discarding message

rsyslogd needs to create these dirs automatically or the rules changed to use files only.

[Dustin Kirkland  (kirkland)]

Thanks, Clint.

I'd like to drop the year/month/date/hostname designation entirely, and just log to the standard logs via rsyslog. Each line printed to log has the hostname and timestamp in it, and those logs are rotated correctly.

Could you try configuring that into your test environment, and see how that looks?

[Marc Cluet (lynxman)]

Hey guys,

After talking with kirikland I'll take care of this bug, we'll make sure of two things

1) find out why that bug is happening (i think we're missing a mkdir -p somewhere)
2) make sure we have a daily cronjob that zips up any non-zipped logs older than 2-days

[Marc Cluet (lynxman)]

Code commited to orchestra (revision 275)

[Launchpad Janitor (janitor)]

This bug was fixed in the package orchestra - 2.21-0ubuntu1

---------------
orchestra (2.21-0ubuntu1) oneiric; urgency=low

  * debian/ubuntu-orchestra-logging-server.postinst
    - Make sure we create the base log directory and apply proper permissions

  * logging-server/etc/cron.d/remote_syslog_compress (LP: #869134)
    - Change the target compress directory from remote to orchestra
    - Change the compression time to 48 hours instead of 24 hours
 -- Marc Cluet <email address hidden> Thu, 06 Oct 2011 17:33:37 +0100

[P.Constantine (pconstantine)]

oadmin@orchestra:~$ tail /var/log/syslog
Feb 10 20:47:07 orchestra rsyslogd: last message repeated 1999 times
Feb 10 20:48:37 orchestra rsyslogd: Could not open dynamic file '/var/log/orchestra/rsyslog/2012/02/10/orchestra/secure' - discarding message
Feb 10 20:49:37 orchestra rsyslogd: last message repeated 999 times
Feb 10 20:50:38 orchestra rsyslogd: last message repeated 2000 times
Feb 10 20:52:08 orchestra rsyslogd: last message repeated 1000 times
Feb 10 20:53:08 orchestra rsyslogd: last message repeated 1000 times
Feb 10 20:54:08 orchestra rsyslogd: last message repeated 1000 times
Feb 10 20:55:08 orchestra rsyslogd: last message repeated 1000 times
Feb 10 20:56:08 orchestra rsyslogd: last message repeated 1000 times
Feb 10 20:57:08 orchestra rsyslogd: last message repeated 1000 times

oadmin@orchestra:~$ dpkg -l | grep orchestra-server
ii ubuntu-orchestra-server 2.21-0ubuntu2.1 Ubuntu Orchestra Services suite

In short: NOT FIXED in orchestra (2.21-0ubuntu2.1)

[Marc Cluet (lynxman)]

Hi P.Contastine

I cannot reproduce your error, the package now makes sure at _install_ time that the permissions are correct in order to rsyslog to write into the directory and makes sure the directory exists.

If you're upgrading the package you'll need to check this permissions manually I'm afraid.

Hope you can fix your installation manually, the package as it is, is fixed

[Chris Sanburn (csanburn)]

I did a fresh install of Orchestra 2 days ago, on Ubuntu 11.10, and am experiencing the exact same thing:

tail /var/log/syslog
Feb 17 06:25:03 orchestra rsyslogd: last message repeated 999 times
Feb 17 06:25:03 orchestra rsyslogd: [origin software="rsyslogd" swVersion="5.8.1" x-pid="842" x-info="http://www.rsyslog.com"] rsyslogd was HUPed
Feb 17 06:26:04 orchestra dnsmasq-dhcp[932]: DHCPREQUEST(eth0) 192.168.124.51 54:04:a6:67:44:ae
Feb 17 06:26:04 orchestra dnsmasq-dhcp[932]: DHCPACK(eth0) 192.168.124.51 54:04:a6:67:44:ae nodeae
Feb 17 06:27:33 orchestra rsyslogd: Could not open dynamic file '/var/log/orchestra/rsyslog/2012/02/17//messages' - discarding message
Feb 17 06:28:33 orchestra rsyslogd: last message repeated 999 times

orchestra@orchestra:/var/log/cobbler$ dpkg -l | grep orchestra-server
ii ubuntu-orchestra-server 2.21-0ubuntu2.1

[Chris Sanburn (csanburn)]

Additionally, it is a permissions and can be fixed manually:
sudo chown syslog:syslog -R /var/log/orchestra/rsyslog

Or it least that fixed it in my case.

The new installation I performed left the rsyslog folder owned by root.

[Clayton Kramer (clayton-kramer)]

I had the same problem. Thanks for posting the easy fix, Chris.