SuSE 10.3 Logger Problems

[diggitydanc]

I've searched the forums a bit and found several people with similar problems, but I can't seem to get the suggested solutions to work. I'm experiencing trouble with the Zimbra Logger Service. zmcontrol status shows that it is running:

zimbra@pp-colo:/root> zmcontrol status
Host pp-colo.pressaprint.com
        antispam                Running
        antivirus               Running
        ldap                    Running
        logger                  Running
        mailbox                 Running
        mta                     Running
        snmp                    Running
        stats                   Running

but I get the message on my status screen that Server status data is not available. To see the server status, logger service must be installed.. I've tried to follow these steps, but the 2nd file that you're supposed to modify does not exist on my system:

Make following steps.

-- work es root --
su zimbra
zmcontrol stop

-- work es root --
killall tail
look for all mounted /dev/shm (multiple mounts possible), umount them

Check the permissions for /var/log/zimbra.log. It's the owner zimbra and rw? Change them if necessary
Check also the size. It's zero byte? --> Bug 1

Have you make any changes in your /etc/syslog-ng/syslog-ng.conf? Yes?
Copy the zimbra changes from "/etc/syslog-ng/syslog-ng.conf.in" to "/etc/syslog-ng/syslog-ng.conf" (the last 5 lines with "#zimbra" comment at end)

Bug 1: Change the line with "killall -HUP syslogd" in this files to "/sbin/rcsyslog restart"

/opt/zimbra/bin/zmsyslogsetup
/opt/zimbra/bin/zmlogrotate
/etc/logrotate.d/zimbra

Restart syslog-ng with: "/sbin/rcsyslog restart"
mount -a
su zimbra
start zimbra (zmcontrol start)


And with some luck, it will work....

and I'm kind of lost after that. I did follow the steps that I could, but afterwards when I attempted to start Zimbra I had several services that failed to start.

Has anyone had any success in getting Zimbra working on SuSE 10.3? I can probably live without the logger service for the time being, but it'll be necessary in the future. Thanks in advance,

--Daniel

[bdial]

check this. It was tailored for a mutliserver install but it might contain some other info for you to look at

Guide: Multi-server logging with openSuSE 10.3 syslog-ng

[diggitydanc]

The suggestions on this thread: Guide: Multi-server logging with openSuSE 10.3 syslog-ng helped me to get this working. Below are the steps I used to get it running. Because I'm not using a multi-server configuration I didn't follow everything, so I'll just highlight what did work for me.

1. Open /etc/syslong-ng/syslog-ng.conf and append these lines to the end of it:

filter f_local0       { facility(local0); }; # zimbra
destination zmail { file("/var/log/zimbra.log" owner("zimbra") ); }; # zimbra
log { source(src); filter(f_mail); destination(zmail); }; # zimbra
destination local0 { file("/var/log/zimbra.log" owner("zimbra") ); }; # zimbra
log { source(src); filter(f_local0); destination(local0); }; # zimbra
filter f_auth       { facility(auth); }; # zimbra
destination zmauth { file("/var/log/zimbra.log" owner("zimbra") ); }; # zimbra
log { source(src); filter(f_auth); destination(zmauth); }; # zimbra

2. Edit /etc/sudoers to allow Zimbra to restart the syslog service. Add this line:

%zimbra ALL=NOPASSWD:/sbin/rcsyslog restart

3. Edit the file /opt/zimbra/conf/zmlogrotate and fine the line that says

/sbin/killall -HUP syslogd 2> /dev/null || true

change that line to say

sudo /sbin/rcsyslog restart 2> /dev/null || true

Now as a good test you should su to the zimbra user, and try the command sudo /sbin/rcsyslog restart . If all goes well, it should restart syslog and you should now have a /var/log/zimbra.log with status updates of the mailbox server currently.

And that was really all that was necessary. Once the syslog service is restarted the Zimbra status displays properly.

Regards,
--Dan

[diggitydanc]

I thought this was a resolved issue, but it has recurred. I double-checked the files I modified originally and they all still contain my updated entries, but the server status does not display. Anyone have any direction for troubleshooting that I can follow to try to track down what the problem is? Thanks in advance,

--Daniel

[bdial]

what part isn't working? is zimbra not logging to /var/log/zimbra? are the messages winding up in /var/log/messages isntead? have you treid restarting syslog?

[diggitydanc]

Sorry, should've been more specific I suppose. I'm getting the message in my admin console that Server status data is not available. Zimbra does seem to be logging to /var/log/zimbra:

pp-colo:~ # tail /var/log/zimbra.log
Jul 24 11:25:27 pp-colo slapd[15554]: conn=216 op=0 BIND dn="uid=zimbra,cn=admins,cn=zimbra" method=128
Jul 24 11:25:27 pp-colo slapd[15554]: conn=216 op=0 BIND dn="uid=zimbra,cn=admins,cn=zimbra" mech=SIMPLE ssf=0
Jul 24 11:25:27 pp-colo slapd[15554]: conn=216 op=0 RESULT tag=97 err=0 text=
Jul 24 11:25:27 pp-colo slapd[15554]: conn=216 op=1 MOD dn="cn=pp-colo.pressaprint.com,cn=servers,cn=zimbra"
Jul 24 11:25:27 pp-colo slapd[15554]: conn=216 op=1 MOD attr=zimbraMailLastPurgedMailboxId
Jul 24 11:25:28 pp-colo slapd[15554]: conn=216 op=1 RESULT tag=103 err=0 text=
Jul 24 11:25:28 pp-colo slapd[15554]: conn=216 op=2 SRCH base="cn=pp-colo.pressaprint.com,cn=servers,cn=zimbra" scope=0 deref=3 filter="(objectClass=*)"
Jul 24 11:25:28 pp-colo slapd[15554]: conn=216 op=2 SEARCH RESULT tag=101 err=0 nentries=1 text=
Jul 24 11:25:28 pp-colo slapd[15554]: conn=216 op=3 UNBIND
Jul 24 11:25:28 pp-colo slapd[15554]: conn=216 fd=11 closed

I have restarted syslog as zimbra via sudo /sbin/rcsyslog restart and it works like it should.

I also read something in this post: logger stopped that suggests that changes should be made to /etc/logrotate.d/zimbra similar to the changes in /opt/zimbra/conf/zmlogrotate.conf. I made those and restarted syslog-ng but it didn't seem to have any effect.

Let me know what I can send over to help or any next steps. I appreciate the help.

--Dan

**Addendum**

I read in one post or another that the trouble with the logging service may have been resolved in an update. I was running 5.0.6 so I took the time to upgrade to 5.0.8. Once I'd completed that upgrade I checked the previously effective steps (changes to /etc/sudoers, changes to /opt/zimbra/conf/zmlogrotate, and changes to /etc/syslog-ng/syslog-ng.conf). I had to remake changes in zmlogrotate and sudoers, but I'm still not getting status in my admin console. Zimbra can restart the logger service and /var/log/zimbra.log belongs to zimbra:zimbra. Thanks for the help,

--Dan

[diggitydanc]

I haven't had a ton of time to pay attention to my Zimbra install lately, but I'm still having trouble with my Logger Status and also with the log files themselves.

I was looking for a message earlier today and noticed that my /var/log/mail still contains entries from back in June. The same is true of my /var/log/zimbra.log file.

What output would be useful to help someone assist me in diagnosing this error? I've double-checked the settings in /opt/zimbra/conf/zmlogrotate and it's set to this:

/var/log/zimbra.log {
    daily
    missingok
    notifempty
    create 0644 zimbra zimbra
    postrotate
      sudo /sbin/rcsyslog restart 2> /dev/null || true
      kill -HUP `cat /opt/zimbra/log/swatch.pid 2> /dev/null` 2> /dev/null || true
      kill -HUP `cat /opt/zimbra/log/logswatch.pid 2> /dev/null` 2> /dev/null || true
    endscript
    compress
}

I believe that is the correct setup and I can run 'sudo /sbin/rcsyslog restart' as zimbra and have it complete, but the logs continue to grow and the admin console status still does not display.

Thanks,

[robbymd]

Just changing the "zimbra_src" to "src" in the following statements in /etc/syslog/syslog-ng.conf fixed this problem for me:

log { source(zimbra_src); filter(zimbra_mail); destination(zimbra_mail); }; # zimbra
log { source(zimbra_src); filter(zimbra_local0); destination(zimbra_local0); }; # zimbra
log { source(zimbra_src); filter(zimbra_local1); destination(zimbra_local1); }; # zimbra
log { source(zimbra_src); filter(zimbra_auth); destination(zimbra_auth); }; # zimbra

Running Zimbra 6.0.6 on SLES 10.2 i586.

[landry41]

I confirm it for DEBIAN R5 with syslog-ng

Just change source(zimbra_src); by source(s_all);

This is the complete part of the syslog-ng.conf for zimbra :

filter zimbra_local0 { facility(local0); }; # zimbra
filter zimbra_local1 { facility(local1); }; # zimbra
filter zimbra_auth { facility(auth); }; # zimbra
filter zimbra_mail { facility(mail); }; # zimbra
destination zimbra_mail { file("/var/log/zimbra.log" owner("zimbra")); }; # zimbra
destination zimbra_local1 { file("/var/log/zimbra-stats.log" owner("zimbra")); }; # zimbra
destination zimbra_local0 { file("/var/log/zimbra.log" owner("zimbra")); }; # zimbra
destination zimbra_auth { file("/var/log/zimbra.log" owner("zimbra")); }; # zimbra
log { source(s_all); filter(zimbra_mail); destination(zimbra_mail); }; # zimbra
log { source(s_all); filter(zimbra_local0); destination(zimbra_local0); }; # zimbra
log { source(s_all); filter(zimbra_local1); destination(zimbra_local1); }; # zimbra
log { source(s_all); filter(zimbra_auth); destination(zimbra_auth); }; # zimbra