Replacing syslog-ng with rsyslog

I have a cluster of OpenSuSe 12.2 servers running Xen. They all have VMs running on them, and some of them use local storage (Makes migrating the VMs off and rebooting out of the question) I want to use rsyslog instead of syslog-ng. I have tried uninstalling syslog-ng and installing rsyslog (compiled from source due to customizations)
When I try running “service syslog status” It is always trying to use /sbin/syslog-ng I want it to use /sbin/rsyslog instead. I edited /etc/sysconfig/syslog through YaST and manually set rsyslog as the syslog daemon, but it still does not take effect when I try to restart syslog it still trys to use /sbin/syslog-ng instead.
As soon as I reboot the server rsyslog starts up and everything works the way it is supposed to, and this worked for the servers without local storage, but the ones with local storage are in production and cannot be shutdown.
Is there any way I can force the OS to re-detect the settings in /etc/sysconfig/syslog?
I have also tried running SuSEconfig with no luck.

Thanks in advance,

  1. Stop syslog service: “systemctl stop syslog.service”
  2. Restart systdmd: “systemctl daemon-reexec”
  3. Start syslog service again: “systemctl start syslog.service”

This should perform the same sequence as during startup, in particular notice that syslog implementation was changed.

I would test in VM first though :slight_smile:

That worked perfectly, and did exactly what I needed it to do. Thank you for your prompt response.

What was the reason for switching to rsyslog?

CzP (openSUSE syslog-ng package co-maintainer)

Syslog-ng is great, and we use it for our master syslog server, but I’m a novice at the C programming language and there was a code change I needed to make to the non-master syslog to make it look by default to a different config file name, and I couldn’t figure out how to do it in syslog-ng. But I could do it in rsyslogd.

However I am still having some problems with OpenSuSe running rsyslog when I run ps ax | grep rsyslog I get:
5887 ? Sl 0:00 /sbin/rsyslogd -c 5 -f /etc/rsyslog.conf
OpenSuSe is forcing the config file on it. I need it to just use the default, because what I"m doing with the rsyslog daemon isn’t compatible with having it be run this way.
I would like rsyslog to run without that -f /etc/rsyslog.conf on the end.
[FONT=Times New Roman]The places where the machine appears to load this intothe command line appears to be in these files:


but I’ve changed those files so it shouldn’t be doingthis any more, in theory. Here’s what the /etc/rc.d/syslog file had in itbefore:

case “$SYSLOG_DAEMON” in
params="-c ${compat:-3} -f $config $RSYSLOGD_PARAMS"

and I edited it (and the very similar ‘earlysyslog’ fileas well) so that it looks like this:

case “$SYSLOG_DAEMON” in
params="-c ${compat:-3}"


Systemd was causing me problems, I was eding the init scripts that don’t get used in the same way they used to. OpenSuSe was just fixing something that wasnt broken. Anyway I just recreated the service in /lib/systemd/system/ by using these steps:

Login as root
cd /lib/system/system
service syslog stop
mv syslog.service syslog.service_old
nano syslog.service
Description=System Logging Service
Conflicts=syslog-ng.service rsyslog.service
systemctl daemon-reload
service syslog start
service syslog status

rsyslog no longer runs with the -c or -f parameters.
I hope this might help lead someone to their solution in the future.

/lib/systemd/system is for packages and can be overwritten without warning by update. Local customizations (including complete unit override) should go into /etc/systemd/system. This also ensures you customization remains valid after move from /lib to /usr/lib in coming versions.

Thank you for pointing this out. I will make sure I make that change in my notes and fix it in the servers I already applied the process to.