A message isn't showing up where expected¶

1. Did it reach journald? journalctl -t <tag> -n 20 or journalctl -g '<text>' --since '5 min ago'.
2. Is rsyslog running and the config valid? systemctl status rsyslog, rsyslogd -N1, journalctl -u rsyslog.
3. Is an earlier rule diverting it? Look for stop/& ~ in lower-numbered drop-ins and in /etc/rsyslog.conf before the include.
4. Is the selector right? Remember facility.err means err and above, not err only.
5. Test the exact facility/priority: logger -p local4.warning -t test "routing test".
6. Check rate limiting: look for "Suppressed" (journald) or "messages lost due to rate-limiting" (rsyslog).

Remote logs not arriving¶

# On the server
sudo ss -ltnup | grep -E ':(514|6514)'
sudo tcpdump -ni any port 514           # is anything arriving at all?
sudo firewall-cmd --list-all            # or: sudo ufw status verbose
sudo ausearch -m avc -ts recent         # SELinux denials (non-standard ports, file paths)
ls -ld /var/log/remote                  # does rsyslog have permission to create files?

# On the client
nc -vz logs.example.com 514             # TCP reachability
sudo ls -lh /var/lib/rsyslog/           # growing queue files = server unreachable
logger -n logs.example.com -P 514 -T "direct test"

Disk filling up with logs¶

sudo du -xh /var/log | sort -h | tail -20
journalctl --disk-usage
sudo journalctl --vacuum-size=500M
sudo lsof +L1 | grep -i log             # deleted files still held open by a process

If df shows the disk full but du doesn't add up, a process is holding a deleted log file open. Restart or reload that process. This is also the classic symptom of rotating with create but no working postrotate reload.

logrotate didn't rotate¶

• Check it ran: journalctl -u logrotate.service, systemctl list-timers logrotate.timer.
• Check the state file to see when it believes it last rotated the file.
• logrotate -d and read the output. Common causes: notifempty with an empty file, minsize not reached, a parent directory that is world- or group-writable (refused unless you add su), a duplicate entry for the same file in two configs (logrotate errors out), or a syntax error in an unrelated file in /etc/logrotate.d/.

Rotated logs aren't compressed¶

• Expected with delaycompress: the newest rotation (.1) stays uncompressed until the next cycle; .2.gz onward are compressed. This is deliberate, for applications that keep writing to the old file descriptor until they're told to reopen.
• If nothing is ever compressed, check that compress is set in the stanza or globally, that nothing later sets nocompress, and that rotation is actually happening more than once.
• If the app doesn't need delayed compression (it reopens on HUP, or you use copytruncate), remove delaycompress.

Journal is empty after reboot¶

The journal is volatile. Create /var/log/journal or set Storage=persistent (see systemd-journald and journalctl).

Corrupted journal files¶

sudo journalctl --verify
# Move bad files aside; journald recreates them
sudo systemctl restart systemd-journald