[Bug 794727] Re: Please symlink /var/log/messages to syslog

[Mike Neish]

Hi Phillip,

While I would be happy to see /var/log/messages return in some form, I
would be cautious about introducing it as a symlink.  What happens if
someone has manually re-enabled it through
/etc/rsyslog.d/50-default.conf while at the same time a new symlink
points from /var/log/messages to /var/log/syslog?  Would there suddenly
be duplicate messages?  Also, I'm not sure how logrotate would handle
this.  Would it archive the symlink on the next rotation, leaving no
/var/log/messages behind?

On the same topic, I had a look at the relevant changelog at
https://launchpad.net/ubuntu/+source/rsyslog/4.6.4-2ubuntu4.  The author
says this change only affects new installations, but I can tell you it's
affecting LTS upgrades as well.  Something to keep in mind as more
people upgrade their servers from 10.04 to 12.04, and wonder where their
logs went...

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to rsyslog in Ubuntu.
https://bugs.launchpad.net/bugs/794727

Title:
  Please symlink /var/log/messages to syslog

Status in “rsyslog” package in Ubuntu:
  Triaged

Bug description:
  Binary package hint: rsyslog

  After upgrading my laptop from Ubuntu 10.10 to Ubuntu 11.04 I found out that the file /var/log/messages contains nothing and is 0 bytes long. /var/log/messages.1 contains the last messages before the upgrade.
  Fearing that something went wrong I checked, if the disk is full and if the syslog daemon running. All looked fine, so googled and found this thread http://ubuntuforums.org/showthread.php?p=10674332 and reading the rsyslog changelog (https://launchpad.net/ubuntu/+source/rsyslog/4.6.4-2ubuntu4) I found out, it is I intentionally change. I strongly oppose this change. /var/log/messages is a long established logfile and available on most unix systems. I can't really buy the performance argument. If the system is logging something it is awake anyway,because it still has to write to /var/log/syslog. If the system is idle it does not log. So I don't see much overhead in logging to two files. Moreover in contrast to the catch-all /var/log/syslog files, which containes a lot of useless information (failed authentications, etc..) it is much easier to spot a real problem in the extract, which /var/log/messages provides.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/rsyslog/+bug/794727/+subscriptions