<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Fehler gefunden:<div class=""><br class=""></div><div class="">Vorgeschichte: jüngst störte mich der Umstand, daß /var/log/journal immer innerhalb weniger Tage</div><div class="">einige GB an logs ansammelte. Ich suchte Rat bei "<a href="http://ubuntuusers.de" class="">ubuntuusers.de</a>" und man empfahl mir:</div><div class=""><br class=""></div><div class=""><div class=""><br class="webkit-block-placeholder"></div><pre class="notranslate">Storage=none
ForwardToSyslog=no
ForwardToWall=no</pre><p class="">
in der "/etc/systemd/journald.conf".</p><div class="">zu setzen, mit den o. geschilderten fatalen Folgen, die mich zur Verzweiflung trieben. Hatte schon einen</div><div class="">Vergleichsserver installiert, war drauf und dran, eine Neuinstallation zu machen, hatte chkrootkit installiert.</div><div class=""><br class=""></div><div class="">Jetzt habe ich eben diese Änderungen in journald.conf rückgängig gemacht und</div><div class="">postfix loggt in mail.log, sshd und andere schön in auth.log, fail2ban funktioniert auf einmal. Gut, jetzt läuft nächtlich </div><div class="">chkrootkit, so what :-)</div><div class=""><br class=""></div><div class="">Alles funktioniert wieder.</div><div class=""><br class=""></div><div class="">Hier vielen Dank für's Mitdenken.</div><div class=""><br class=""></div><div class="">Grüße</div><div class="">Christoph</div><div class=""><br class=""></div><div><blockquote type="cite" class=""><div class="">Am 05.10.2023 um 09:36 schrieb Christoph Kukulies <<a href="mailto:kuku@kukulies.org" class="">kuku@kukulies.org</a>>:</div><br class="Apple-interchange-newline"><div class=""><meta charset="UTF-8" class=""><div class="" style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><br class="Apple-interchange-newline"><br class="Apple-interchange-newline"></div><div style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><br class=""><blockquote type="cite" class=""><div class="">Am 05.10.2023 um 02:22 schrieb Alex <<a href="mailto:al-pfusde@none.at" class="">al-pfusde@none.at</a>>:</div><br class="Apple-interchange-newline"><div class=""><div class="">On 2023-10-04 (Mi.) 21:37, Christoph Kukulies wrote:<br class=""><blockquote type="cite" class="">Das war leider ein Irrtum.<br class="">Gar keine postfix logs mehr.<br class=""></blockquote><br class="">Was ist der output von?<br class="">```<br class="">root@mail ~ # ls -la /var/spool/postfix/dev/<br class="">total 8<br class="">drwxr-xr-x 2 root root 4096 Oct 4 10:07 .<br class="">drwxr-xr-x 23 root root 4096 Jun 27 00:04 ..<br class="">srw-rw-rw- 1 root root 0 Oct 4 10:06 log<br class="">crw-rw-rw- 1 root root 1, 8 Oct 4 10:07 random<br class="">crw-rw-rw- 1 root root 1, 9 Oct 4 10:07 urandom<br class="">```<br class=""><br class=""></div></div></blockquote><div class=""><br class=""></div><div class=""><br class=""></div>Das sieht bei mir genauso aus:</div><div style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><br class=""></div><span class="" style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><font face="Courier" class="">root@mail:~# ls -la /var/spool/postfix/dev<br class="">total 8<br class="">drwxr-xr-x 2 root root 4096 Oct 4 19:28 .<br class="">drwxr-xr-x 20 root root 4096 Sep 24 13:02 ..<br class="">srw-rw-rw- 1 root root 0 Oct 4 19:28 log<br class="">crw-rw-rw- 1 root root 1, 8 Oct 4 19:28 random<br class="">crw-rw-rw- 1 root root 1, 9 Oct 4 19:28 urandom<br class="">root@mail:~# <br class=""><br class=""></font></span><span class="" style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><br class=""><blockquote type="cite" class="">falls du da ein `log` hast versuch mal die Datei anzulegen und den rsyslogd zu restarten.<br class=""></blockquote><div class=""><span class=""><br class=""></span></div>Versteh' nicht: wenn ich da ein log habe? Meinst Du "kein log hast"? log ist ein socket, den kann ich nicht aus der shell heraus anlegen,</span><div class="" style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><span class="">wüßte aus dem Stegreif jetzt nicht wie.</span></div><div class="" style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><span class=""><br class=""><blockquote type="cite" class=""><br class="">```<br class="">root@mail ~ # cat /etc/rsyslog.d/postfix.conf<br class=""># Create an additional socket in postfix's chroot in order not to break<br class=""># mail logging when rsyslog is restarted. If the directory is missing,<br class=""># rsyslog will silently skip creating the socket.<br class="">$AddUnixListenSocket /var/spool/postfix/dev/log<br class="">```<br class=""><br class=""><blockquote type="cite" class="">rsyslogd läuft<br class="">Noch reichlich Platz auf der Platte<br class="">Grüße<br class="">Christoph<br class=""></blockquote><br class=""></blockquote><div class=""><span class=""><br class=""></span></div><div class=""><span class=""><br class=""></span></div>Aber es wird überhaupt nichts mehr geloggt, auch nicht von z.B. sshd.</span></div><div class="" style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><span class=""><br class=""></span></div><div class="" style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><span class="">Es ist wohl ein grundsätzliches Problem mit meiner rsyslog-Konfiguration.</span></div><div class="" style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><span class=""><br class=""></span></div><div class="" style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><span class="">Danke jedenfalls erst mal. Melde mich, wie's ausgeht.</span></div><div class="" style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><span class=""><br class=""></span></div><div class="" style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><span class="">Grüße</span></div><div class="" style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><span class="">Christoph</span></div><div class="" style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><span class=""><br class=""></span></div><div class="" style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><span class=""><blockquote type="cite" class="">LG<br class="">Alex<br class=""><br class=""><blockquote type="cite" class=""><blockquote type="cite" class="">Am 04.10.2023 um 21:14 schrieb Markus Winkler <<a href="mailto:ml@irmawi.de" class="">ml@irmawi.de</a>>:<br class="">On 04.10.23 19:55, Christoph Kukulies wrote:<br class=""><blockquote type="cite" class="">aber im Moment loggt rsyslogd gar nichts, außer dem Hochfahren des<br class="">kernels. Danach ist nichts mehr im syslog.<br class=""></blockquote><br class="">Das verstehe ich jetzt nicht - Du hattest doch heute Mittag geschrieben,<br class="">dass die Postfix-Logs zumindest in /var/log/syslog zu sehen sind?<br class=""><br class="">Daher stellen sich diese ganzen trivialen Fragen: Wurde zwischenzeitlich<br class="">etwas geändert? Läuft Rsyslogd überhaupt? Platte voll?<br class=""><br class="">Gruß<br class="">Markus</blockquote></blockquote></blockquote></span></div></div></blockquote></div><br class=""></div></body></html>