At least it wasn’t on mine, which I think came from a Rocky Linux 8.4 ISO and was updated to 8.6. I was trying to solve a problem that required me to look at the mail log, and when I looked for it it wasn’t there.
As it turns out, rsyslog wasn’t installed. That also explained why CSF had been mighty quiet.
In any case, it’s in the repo. Installing it solved the CSF problem. I still can’t troubleshoot the other one because I need to give it time to populate the log.
Basically, I’m not getting notices of successful backups. But it may be that the mail provider is blocking them; so I have to wait for the next backup run. It also could be that the notifications depend on a log that didn’t exist, however; so maybe that problem is fixed, too.
It’s not expected to be installed. The problem is that the only way to view logs in Webmin expects some implementation of syslog. But, there’s no reason for it to insist on the existence of syslog. Ilia copied the existing syslog module and made a new View Logs module (basically all the same code without the syslog dependency). It will be included in the next version of Webmin.
This won’t address anything to do with CSF, but that’s not our concern (we don’t maintain CSF and it is not a part of our default install). If CSF requires rsyslog, it should be a dependency of the CSF package, not anything in Virtualmin. But, there’s no reason for it to, journald provides a syslog compatible interface in addition to simpler ways to get logs into the journal. (But, I don’t know anything about configuring CSF to use it. Not my monkey, not my problem.)
CSF may have an alternative way to do its thing. I haven’t pored through the bazillion pages of documentation in a while.
I do know that CSF itself hardens syslog by default, but doesn’t install it. I was surprised that Rocky doesn’t install it because every other Linux I ever used did, as far as I can recall.
rsyslog is unnecessary in a reasonably modern systemd system, since journald handles all service logging and also provides a syslog compatible interface for services that need it. There’s a bunch of info about this, but a quick google turns up this decent little summary article: Why Journald?
You know, CSF may already work with Journald. I copied the configuration over from a server running CentOS 7 to save some time. Copying the config means I only have to change two lines manually. I’ve done it many times before without issue, but never on an RH8 compatible system.
In other words, I may have broken that functionality. I’ll pore through it when I have some time.
