trixie hosts have trouble with syslog

it looks like the trixie hosts don't like syslog-ng:

root@idle-dal-03:~# systemctl --failed
  UNIT              LOAD   ACTIVE SUB    DESCRIPTION     
● logrotate.service loaded failed failed Rotate log files

Legend: LOAD   → Reflects whether the unit definition was properly loaded.
        ACTIVE → The high-level unit activation state, i.e. generalization of SUB.
        SUB    → The low-level unit activation state, values depend on unit type.

1 loaded units listed.
root@idle-dal-03:~# systemctl status logrotate
× logrotate.service - Rotate log files
     Loaded: loaded (/usr/lib/systemd/system/logrotate.service; static)
    Drop-In: /etc/systemd/system/logrotate.service.d
             └─logrotate-syslog-ng-dep.conf
     Active: failed (Result: exit-code) since Fri 2025-04-18 00:21:33 UTC; 3h 22min ago
 Invocation: 621ebc41431446fd9e0ab4621f6ba96e
TriggeredBy: ● logrotate.timer
       Docs: man:logrotate(8)
             man:logrotate.conf(5)
    Process: 44492 ExecStart=/usr/sbin/logrotate /etc/logrotate.conf (code=exited, status=1/FAILURE)
   Main PID: 44492 (code=exited, status=1/FAILURE)
   Mem peak: 4.4M
        CPU: 159ms

Apr 18 00:21:33 idle-dal-03 systemd[1]: Starting logrotate.service - Rotate log files...
Apr 18 00:21:33 idle-dal-03 logrotate[44494]: invoke-rc.d: initscript syslog-ng, action "reload" failed.
Apr 18 00:21:33 idle-dal-03 logrotate[44492]: error: error running non-shared postrotate script for /var/log/syslog of '/var/log/syslog'
Apr 18 00:21:33 idle-dal-03 systemd[1]: logrotate.service: Main process exited, code=exited, status=1/FAILURE
Apr 18 00:21:33 idle-dal-03 systemd[1]: logrotate.service: Failed with result 'exit-code'.
Apr 18 00:21:33 idle-dal-03 systemd[1]: Failed to start logrotate.service - Rotate log files.
root@idle-dal-03:~# systemctl status syslog-ng
○ syslog-ng.service - System Logger Daemon
     Loaded: loaded (/usr/lib/systemd/system/syslog-ng.service; disabled; preset: enabled)
     Active: inactive (dead)
       Docs: man:syslog-ng(8)

Apr 18 00:21:33 idle-dal-03 systemd[1]: syslog-ng.service: Unit cannot be reloaded because it is inactive.

in other words, logrotate crashed because it couldn't restart syslog because it wasn't started because it was disabled?

workaround: restart syslog:

root@idle-dal-03:~# systemctl restart syslog-ng
root@idle-dal-03:~# systemctl status syslog-ng
● syslog-ng.service - System Logger Daemon
     Loaded: loaded (/usr/lib/systemd/system/syslog-ng.service; disabled; preset: enabled)
     Active: active (running) since Fri 2025-04-18 03:45:40 UTC; 1s ago
 Invocation: 196827f7e8d8466e807bfbd7f0c0f404
       Docs: man:syslog-ng(8)
   Main PID: 59097 (syslog-ng)
      Tasks: 4 (limit: 505)
     Memory: 39.4M (peak: 39.9M)
        CPU: 389ms
     CGroup: /system.slice/syslog-ng.service
             └─59097 /usr/sbin/syslog-ng -F

Apr 18 03:45:40 idle-dal-03 systemd[1]: Starting syslog-ng.service - System Logger Daemon...
Apr 18 03:45:40 idle-dal-03 (yslog-ng)[59097]: syslog-ng.service: Referenced but unset environment variable evaluates to an empty string: SYSLOGNG_OPTS
Apr 18 03:45:40 idle-dal-03 syslog-ng[59097]: [2025-04-18T03:45:40.637216] WARNING: Configuration file format is too old, syslog-ng is running in compatibility mode. Please update it to use the syslog-ng 4.8 format at your time of convenience. To upgrade the configuration,>
Apr 18 03:45:40 idle-dal-03 syslog-ng[59097]: [2025-04-18T03:45:40.637216] WARNING: Your configuration file uses an obsoleted keyword, please update your configuration; keyword='stats_freq', change='Use the stats() block. E.g. stats(freq(1));', location='/etc/syslog-ng/sys>
Apr 18 03:45:40 idle-dal-03 syslog-ng[59097]: [2025-04-18T03:45:40.637216] WARNING: The internal_queue_length stat counter has been renamed to internal_source.queued; config-version='3.3'
Apr 18 03:45:40 idle-dal-03 syslog-ng[59097]: [2025-04-18T03:45:40.637216] WARNING: Default value changed for the prefix() option of systemd-journal source in syslog-ng 3.8; old_value='', new_value='.journald.'
Apr 18 03:45:40 idle-dal-03 syslog-ng[59097]: [2025-04-18T03:45:40.637216] systemd-journal: Current position does not match the previously restored cursor position, seeking to head; cursor='s=1850dd382ef847eea943a836c866db30;i=288cd;b=b3e6306b3e734ad88e0924936a4aef52;m=2a5>
Apr 18 03:45:40 idle-dal-03 systemd[1]: Started syslog-ng.service - System Logger Daemon.
root@idle-dal-03:~# systemctl restart logrotate
root@idle-dal-03:~# systemctl --failed
  UNIT LOAD ACTIVE SUB DESCRIPTION

0 loaded units listed.

but i'm wondering what's going on here.

in fact, i'm wondering if we even need syslog at this point. maybe it's fine that it's gone, and we should disable logrotate instead? or at least make it survive a syslog outage?

Assignee Loading
Time tracking Loading