System Logs Viewer - Missing logs

[shoulders]

My dev site has more logs in the System Logs Viewer than my live site and My fresh install server (4 weeks ago ish)

Dev Server

SYSTEM INFORMATION
OS type and version	Ubuntu Linux 22.04.4
Webmin version	2.111
Usermin version	2.010
Virtualmin version	7.10.0
Theme version	21.10
Package updates	85 package updates are available

Live site

SYSTEM INFORMATION
OS type and version	Ubuntu Linux 22.04.4
Webmin version	2.111
Usermin version	2.010
Virtualmin version	7.10.0
Theme version	21.10
Package updates	All installed packages are up to date

Question

Is this an intentional change or is something broken?

These are missing

• File /var/log/mail.err mail.err
• File /var/log/auth.log auth,authpriv.*
• File /var/log/syslog . ; auth,authpriv.none
• File /var/log/kern.log kern.*
• File /var/log/mail.log mail.*

Thanks

[Joe]

You’ve configured one of them to log to mail logs, the other is using the default of logging to the journal.

[Joe]

It’s also possible they’re configured the same, but the ones without those logs don’t have mail services running.

[shoulders]

I have the System Logs and System Logs Viewer installed on my dev site with the extra entries.

Virtualmin will not let me install Systems Logs on my fresh’ish install to see if it is this that has caused the issue.

How do I get rid of this module or at least disable it. It is classed as used

Continuing the discussion from [Removing unwanted Modules for better security](https://

@Ilia

We wouldn’t recommend removing (deleting) modules from Webmin installation directory but rather disabled those modules for users using Webmin Users > username > Available Webmin Modules page:

Is there a disable option rather than a delete? Disabling by username would involve going to each user and I am not sure it if would remove anything i.e. those extra entries in the log.

There are mail ones, but is this not a kernel File /var/log/kern.log kern.*

Cheers

[Joe]

Try using Refresh Modules. Maybe it’ll figure out you don’t have rsyslog. I think it just checks for the config file, and if one doesn’t exist, it’ll be considered unused.

[shoulders]

@joe thanks your help is always appreciated.

the refresh module idea did not work, but I am going to have a play tomorrow and when I get it fixed will post the solution.

I think the extra entries was created by the System Logs module and then used by the new System Logs Viewer

[Ilia]

@shoulders

These are missing

• File /var/log/mail.err mail.err
• File /var/log/auth.log auth,authpriv.*
• File /var/log/syslog . ; auth,authpriv.none
• File /var/log/kern.log kern.*
• File /var/log/mail.log mail.*

These aren’t missing – it’s expected not to have them, as journald doesn’t have those logs.

[Ilia]

@shoulders

Is there a disable option rather than a delete?

Did you perhaps install rsyslog package manually?

[shoulders]

I don’t remember installing anything, not saying I did, but I probably saw the module and clicked and install button.

This is only my dev site, so nothing is lost.

But I wonder how it happend.

I will look to see if rsyslog is installed.

Also I am sure I have been using some of them via the view button. I will add further information tommorow.

[shoulders]

@Ilia

Did you perhaps install rsyslog package manually?

I didn’t install it manually but it is present on my dev site with both log viewers.

It is not present on my live site

I will uninstall rsyslog and see what happens

Additional

In both System Logs and System Logs Viewer there is a configuration option called Show logs from other modules?which reduces.increases what logs it shows. I am not sure how this interaction works just that it is there.

the new System Logs Viewer is missing these (I can add them manually) but I think they perhaps should be part of the default. I do miss the mail ones as it is helpful to diagnost mail only issues.

• /var/log/auth.log
• /var/log/syslog (not sure what this one is for)
• /var/log/kern.log
• /var/log/mail.log
• /var/log/mail.err

p.s.

• on my live site these log files do not exist.
• Is it possble to add filtering of the logs by postfix/smtpd, dovecot etc…
• add the ability to add our own journal commands, not just log files.

For reference

this is the System Logs page from my dev site

I have not learned about Logs yet because I have been sorting my mail server (can you tell )

[Ilia]

Ubuntu 22.04 should have both modules working, i.e., System Logs and System Logs Viewer, because rsyslog is still installed by default in Ubuntu 22.04, and it’s a systemd system.

[shoulders]

The only difference between my virtualmin installs linux wise is that I will of used a slightly different point release of ubuntu when I installed, all 22.0x.x

I always use ths minimal server version.

According to this thread it looks like Ubuntu are moving away from rsyslog and focussing on Journalctl so it would make sense that it was removed between point releases.

Is it expected to not have `rsyslog` installed after a fresh install of ubuntu server?

• The minimized image does not contain rsyslog. Your experience is expected.
• You are right that journald is still installed as part of systemd. The /dev/log file has pointed to journald for several LTS releases now. The default settings for journald include ForwardToSyslog=yes, which is why rsyslog still processes logs when installed.

Conclusion

System Logs module is not present/used because rsyslog was never installed and I have one virtualmin setup with and 2 virtualmins without rsyslog because Ubuntu have removed it from the default minimal server installer.

NB: the 2 without rsyslog were made after the one with.