Ubuntu 14.04 System Logging
I've set up an Ubuntu 14.04 Server (from an Ubuntu 12.04 Server) but today I wanted to look in the auth.log but this file is not used. It seems that ´syslog´ was deleted.
How does Ubuntu 14.04 log? I need this for a server.
Thank you.
14.04 uses rsyslog. When I upgraded from 12.04 to 14.04 I had to change the owner of the logfiles in /var/log from root to syslog.
(In /etc/rsyslog.conf the owner is defined as
$FileOwner syslog
$FileGroup adm
)
You should also take a look at /etc/rsyslog.d/50-default.conf where it is defined which events are logged to which files. There is also a line for /var/log/syslog. Maybe it's commented out.
I just performed a brand new install of Ubuntu 14.04 using the official server media.
Rsyslog was installed, and the auth.log a valid log file with the default configuration. It is configured by the file /etc/rsyslog.d/50-default.conf
If you do not have an auth.log then I must assume you did one of the following:
- changed the config
- used a syslog daemon other than rsyslog
- used an Ubuntu installer that set different defaults.
Without knowing exactly what syslog daemon you are using it is difficult to tell.
If you are using rsyslog, then take a look at your /etc/rsyslog.conf, and any files in /etc/rsyslog.d. See where the auth,authpriv.* messages are being logged to.