🐛 Bug: SYSLOG Error

[sshcli]

CSF › Version

15.06

CSF › Release

Stable

System › OS

Linux

System › Distro & Version

24.04

Control Panel › Name

Webmin

Priority

Low

Issue Description

You constantly get this notification email:
Error: Failed to detect code [gs4J5EntmPZJflLmXIMuJ4u40Dp8] in SYSLOG_LOG [/var/log/messages]
SYSLOG may not be running correctly on server.example.com

Steps To Reproduce

1. Install CSF Firewall + Webmin + Virtualmin
2. In csf -> Firewall profiles -> Set to protection_high
3. Enable "LF_ALERT_TO" to receive notifications by email
4. Take a look at all notifications you receive by email

Logs › Lfd

No response

Config › csf.conf

No response

Screenshots

No response

[Aetherinox]

Thus far the initial tests on my end turned out correct.

# check syslog daemon runing
ps aux | grep -E 'rsyslog|syslog-ng|journald'

# see what syslog is defined as in config
grep '^SYSLOG_LOG' /etc/csf/csf.conf

# file exists and is writable
ls -l $(grep '^SYSLOG_LOG' /etc/csf/csf.conf | awk -F'=' '{print $2}' | xargs)

# test syslog logging
logger "csf syslog test $(date)"
sleep 2
grep "csf syslog test" /var/log/messages /var/log/syslog 2>/dev/null

The log file should be writable by lfd, confirm SYSLOG_LOG is correct.

[sshcli]

It says: No such file or directory

root@vm:~# ps aux | grep -E 'rsyslog|syslog-ng|journald'
root         378  0.0  0.0  34184 14552 ?        S<s  13:53   0:05 /usr/lib/systemd/systemd-journald
syslog       873  0.0  0.0 222508  5888 ?        Ssl  13:53   0:01 /usr/sbin/rsyslogd -n -iNONE
root       40718  0.0  0.0   3528  1792 pts/0    S+   16:03   0:00 grep --color=auto -E rsyslog|syslog-ng|journald
root@vm:~# grep '^SYSLOG_LOG' /etc/csf/csf.conf
SYSLOG_LOG = "/var/log/messages"
root@vm:~# ls -l $(grep '^SYSLOG_LOG' /etc/csf/csf.conf | awk -F'=' '{print $2}' | xargs)
ls: cannot access '/var/log/messages': No such file or directory
root@vm:~# logger "csf syslog test $(date)"
root@vm:~# sleep 2
root@vm:~# grep "csf syslog test" /var/log/messages /var/log/syslog 2>/dev/null
/var/log/syslog:2025-10-23T16:04:13.952461-04:00 vm root: csf syslog test Thu Oct 23 16:04:13 AST 2025
root@vm:~# 

[sshcli]

btw, I also saw the same error in a cPanel installation. Not only Webmin

[scysys]

Check /var/log/syslog instead of /var/log/messages

[sshcli]

Check /var/log/syslog instead of /var/log/messages

Yes. The syslog file exists, and works. Thanks

but....

Why it has been changed to messages instead of syslog?
This is the bug

As far as I remember, I haven't touched that setting.

It is even a restricted menu UI item, so, I can't change it from GUI

[sshcli]

Just FYI.
I have solved my problem by changing to /var/log/syslog (Thanks @scysys)

If you consider this is not a bug, and it is just a pure Layer 8 issue, then, please feel free to close this issue as solved.

Thanks

[Aetherinox]

I'm currently shuffling in my head with this. Because if there's a way to make it better, or at least point a user in the direction of the issue, then I'd rather do that than ignore it and it come up again for another user.

I'm just debating the best course.

[sshcli]

if you ask me, it is just adding an extra line of code in the installation script, to make sure to always use /var/log/syslog.
if empty, add /var/log/syslog
if != /var/log/syslog, replace by /var/log/syslog

[scysys]

/var/log/messages does not exists by default on ubuntu. Updating the install or config script to default to /var/log/syslog would prevent confusion for future users.

[Aetherinox]

So after looking into this a bit more.

RHEL systems default to /var/log/messages, at least a lot of the older RHEL systems did, which is why I'm going to assume the default path was set to /var/log/messages. And CSF long ago was primarily used on RHEL systems.

Debian-based systems use /var/log/syslog.

So we will probably have to dynamically set this based on the system at install. If we do this at run-time, this will confuse users who opt to change this value. They'll wonder why their custom path is not sticking because our system is overriding their change.