No Zimbra Logging - CentOS 8

[mickwilli]

Hi all,

This is my first (attempted) installed of Zimbra. I am using a CentOS 8 virtual machine (on a HyperV host for my sins), with the latest version of Zimbra. I have created a symlink for /opt/zimbra to a separate 'drive' to ensure there is plenty of space for the Zimbra data.

Zimbra is successfully installed and I am able to access the various web interfaces. However, I noticed, while trying to troubleshoot some issues, that the /var/log/zimbra.log and zimbra-stats.log are both empty. Additionally I notice that in the Zimbra web interface, all of the services are showing as offline, however when checking these at the command line, I can see that they are all running as expected. I understand from searching that this is related to the empty log files.

When I first installed Zimbra, I did not have rsyslog installed on the server. I have since installed this via yum, uninstalled and then reinstalled Zimbra. However, the log files remain empty, despite postfix activities that should have resulted in log entries.

Any ideas what's happening here? Any help would be much appreciated.

[H_Rocky]

I solved the same problem.
You need to change the value in logrotate: /etc/logrotate.d/zimbra
change the parameters in the paragraph (first two):
/var/log/zimbra.log:

Code: Select all

kill -HUP `cat /var/run/rsyslog*.pid 2> / dev / null` 2> / dev / null || true

/var/log/zimbra-stats.log

Code: Select all

kill -HUP `cat /var/run/rsyslog*.pid 2> / dev / null` 2> / dev / null || true

save and restart syslog service:

Code: Select all

systemctl restart rsyslog

[L. Mark Stone]

Thanks for posting your fix!

FWIW this is a known issue with ZBUG-1843 having a status of assigned.

Last month the bug detail status indicated that a fix was targeted for 8.8.15 Patch 15/9.0.0 Patch 8, but now the bug detail status reads "This issue is being investigated. We will announce a release timeline once we have it fixed."

I've posted a link to this thread in the bug's Comments section; hopefully that will help.

All the best,
Mark

[mickwilli]

Hey, thanks for the message - good to know it's not just me and it's a known bug/issue.

Unfortunately however, that fix hasn't worked for me.

I've updated the zimbra logrotate.d file as you have suggested (I copied and pasted the relevant lines). Here's an excerpt from that file after having made the change:

Code: Select all

/var/log/zimbra.log {
    daily
    missingok
    notifempty
    create 0644 USER GROUP
    postrotate
      kill -HUP `cat /var/run/rsyslog*.pid 2> / dev / null` 2> / dev / null || true
      su - zimbra -c "/opt/zimbra/bin/zmconfigdctl restart" > /dev/null 2>&1 || true
    endscript
    compress
}

/var/log/zimbra-stats.log {
    daily
    missingok
    notifempty
    create 0644 USER GROUP
    postrotate
      kill -HUP `cat /var/run/rsyslog*.pid 2> / dev / null` 2> / dev / null || true
      su - zimbra -c "/opt/zimbra/bin/zmconfigdctl restart" > /dev/null 2>&1 || true
    endscript
    rotate 0
}

Unfortunately, still nothing being logged into either file:

Code: Select all

[root@zimbra log]# ls -l | grep zimbra
-rw-r--r--  1 zimbra zimbra         0 Oct 22 15:03 zimbra.log
-rw-r--r--  1 zimbra zimbra         0 Oct 22 15:20 zimbra-stats.log

I tried restarting the server as a whole, for good measure, but that hasn't helped.

Did I miss something here, or maybe something is slightly different in my version?

[H_Rocky]

Paste the contents of the configuration: /etc/rsyslog.conf

[mickwilli]

/etc/rsyslog.com

Code: Select all

[root@zimbra etc]# cat rsyslog.conf
# rsyslog configuration file

# For more information see /usr/share/doc/rsyslog-*/rsyslog_conf.html
# or latest version online at http://www.rsyslog.com/doc/rsyslog_conf.html
# If you experience problems, see http://www.rsyslog.com/doc/troubleshoot.html

#### MODULES ####

module(load="imuxsock"      # provides support for local system logging (e.g. via logger command)
       SysSock.Use="off") # Turn off message reception via local log socket;
           # local messages are retrieved through imjournal now.
module(load="imjournal"        # provides access to the systemd journal
       StateFile="imjournal.state") # File to store the position in the journal
#module(load="imklog") # reads kernel messages (the same are read from journald)
#module(load"immark") # provides --MARK-- message capability

# Provides UDP syslog reception
# for parameters see http://www.rsyslog.com/doc/imudp.html
module(load="imudp") # needs to be done just once
input(type="imudp" port="514")

# Provides TCP syslog reception
# for parameters see http://www.rsyslog.com/doc/imtcp.html
#module(load="imtcp") # needs to be done just once
#input(type="imtcp" port="514")

#### GLOBAL DIRECTIVES ####

# Where to place auxiliary files
global(workDirectory="/var/lib/rsyslog")

# Use default timestamp format
module(load="builtin:omfile" Template="RSYSLOG_TraditionalFileFormat")

# Include all config files in /etc/rsyslog.d/
include(file="/etc/rsyslog.d/*.conf" mode="optional")

#### RULES ####

# Log all kernel messages to the console.
# Logging much else clutters up the screen.
#kern.*                                                 /dev/console

# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;mail.none;authpriv.none;cron.none                /var/log/messages

# The authpriv file has restricted access.
authpriv.*                                              /var/log/secure

# Log all the mail messages in one place.
mail.*                                                  -/var/log/maillog


# Log cron stuff
cron.*                                                  /var/log/cron

# Everybody gets emergency messages
*.emerg                                                 :omusrmsg:*

# Save news errors of level crit and higher in a special file.
uucp,news.crit                                          /var/log/spooler

# Save boot messages also to boot.log
local7.*                                                /var/log/boot.log


# ### sample forwarding rule ###
#action(type="omfwd" 
# An on-disk queue is created for this action. If the remote host is
# down, messages are spooled to disk and sent when it is up again.
#queue.filename="fwdRule1"       # unique name prefix for spool files
#queue.maxdiskspace="1g"         # 1gb space limit (use as much as possible)
#queue.saveonshutdown="on"       # save messages to disk on shutdown
#queue.type="LinkedList"         # run asynchronously
#action.resumeRetryCount="-1"    # infinite retries if host is down
# Remote Logging (we use TCP for reliable delivery)
# remote_host is: name/ip, e.g. 192.168.0.1, port optional e.g. 10514
#Target="remote_host" Port="XXX" Protocol="tcp")

[H_Rocky]

Thank you for the submitted configuration.
The configuration is incorrect. You need to run as root:

Code: Select all

/opt/zimbra/libexec/zmsyslogsetup

Next,

Code: Select all

systemctl restart rsyslog

Check the

Code: Select all

systemctl status rsyslog

Check if /var/log/zimbra.log is filling the data

/etc/rsyslog.conf looks like this:

Code: Select all

cat /etc/rsyslog.conf
# rsyslog configuration file

# For more information see /usr/share/doc/rsyslog-*/rsyslog_conf.html
# or latest version online at http://www.rsyslog.com/doc/rsyslog_conf.html
# If you experience problems, see http://www.rsyslog.com/doc/troubleshoot.html

#### MODULES ####

module(load="imuxsock"      # provides support for local system logging (e.g. via logger command)
       SysSock.Use="off") # Turn off message reception via local log socket;
           # local messages are retrieved through imjournal now.
module(load="imjournal"        # provides access to the systemd journal
       StateFile="imjournal.state") # File to store the position in the journal
#module(load="imklog") # reads kernel messages (the same are read from journald)
#module(load"immark") # provides --MARK-- message capability

# Provides UDP syslog reception
# for parameters see http://www.rsyslog.com/doc/imudp.html
#module(load="imudp") # needs to be done just once
#input(type="imudp" port="514")

# Provides TCP syslog reception
# for parameters see http://www.rsyslog.com/doc/imtcp.html
#module(load="imtcp") # needs to be done just once
#input(type="imtcp" port="514")

#### GLOBAL DIRECTIVES ####

# Where to place auxiliary files
global(workDirectory="/var/lib/rsyslog")

# Use default timestamp format
module(load="builtin:omfile" Template="RSYSLOG_TraditionalFileFormat")

# Include all config files in /etc/rsyslog.d/
include(file="/etc/rsyslog.d/*.conf" mode="optional")

#### RULES ####

# Log all kernel messages to the console.
# Logging much else clutters up the screen.
#kern.*                                                 /dev/console

# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;local0.none;local1.none;mail.none;auth.none;authpriv.none;cron.none                /var/log/messages

# The authpriv file has restricted access.
authpriv.*                                              /var/log/secure

# Log all the mail messages in one place.

# Log cron stuff
cron.*                                                  /var/log/cron

# Everybody gets emergency messages
*.emerg                                                 :omusrmsg:*

# Save news errors of level crit and higher in a special file.
uucp,news.crit                                          /var/log/spooler

# Save boot messages also to boot.log
local7.*                                                /var/log/boot.log


# ### sample forwarding rule ###
#action(type="omfwd" 
# An on-disk queue is created for this action. If the remote host is
# down, messages are spooled to disk and sent when it is up again.
#queue.filename="fwdRule1"       # unique name prefix for spool files
#queue.maxdiskspace="1g"         # 1gb space limit (use as much as possible)
#queue.saveonshutdown="on"       # save messages to disk on shutdown
#queue.type="LinkedList"         # run asynchronously
#action.resumeRetryCount="-1"    # infinite retries if host is down
# Remote Logging (we use TCP for reliable delivery)
# remote_host is: name/ip, e.g. 192.168.0.1, port optional e.g. 10514
#Target="remote_host" Port="XXX" Protocol="tcp")
local0.*                -/var/log/zimbra.log
local1.*                -/var/log/zimbra-stats.log
auth.*                  -/var/log/zimbra.log
mail.*                -/var/log/zimbra.log


[mickwilli]

Thanks for that, that looks to have solved the issue, the log files now have some log entries in them, as I would expect.

Thanks for the help, much appreciated. Good to have working logging now!

[H_Rocky]

I am happy to help solve problems.

After editing /etc/rsyslog.conf and /etc/logrotate.d/zimbra, logging will work.

[mickwilli]

But wait, there's more....

So after I got this going, it worked fine for a few days, then logging appears to have stopped again.

It looks to me like logrotate occurs and after that, the log files are empty again:

Code: Select all

[zimbra@zimbra log]$ ls -l | grep zimbra
-rw-r--r--  1 zimbra zimbra        0 Nov 16 03:29 zimbra.log
-rw-r--r--  1 zimbra zimbra    87482 Nov 11 03:50 zimbra.log-20201111.gz
-rw-r--r--  1 zimbra zimbra    47695 Nov 14 03:20 zimbra.log-20201114.gz
-rw-r--r--  1 zimbra zimbra    75599 Nov 16 03:28 zimbra.log-20201116.gz
-rw-r--r--  1 zimbra zimbra        0 Nov 16 03:29 zimbra-stats.log

I can simply restart the rsyslog service via the old

Code: Select all

systemctl restart rsyslog

and the logging appears to resume...

Code: Select all

[root@zimbra log]# ls -l | grep zimbra
-rw-r--r--  1 zimbra zimbra      581 Nov 17 12:24 zimbra.log
-rw-r--r--  1 zimbra zimbra    87482 Nov 11 03:50 zimbra.log-20201111.gz
-rw-r--r--  1 zimbra zimbra    47695 Nov 14 03:20 zimbra.log-20201114.gz
-rw-r--r--  1 zimbra zimbra    75599 Nov 16 03:28 zimbra.log-20201116.gz
-rw-r--r--  1 zimbra zimbra     5957 Nov 17 12:24 zimbra-stats.log

It's not world ending, but rather frustrating. Seems to last around 3-4 days before bombing out again.

Any ideas what's causing that to occur? Anyone else experiencing the same issues?