Error: syslog:1 lines must begin with a keyword or a filename

Not sure why this keeps coming up,
I upgraded centos 7 to Alma linux and now i have nothing but issues with syslog.

that’ll be a logrotate error.

have a look at the first line of /etc/logrotate.d/syslog - make sure you haven’t been editing the file using windows

This is what is in that file
/var/log/cron
/var/log/maillog
/var/log/messages
/var/log/secure
/var/log/spooler
{
compress
missingok
sharedscripts
postrotate
/usr/bin/systemctl kill -s HUP rsyslog.service >/dev/null 2>&1 || true
endscript
}

For reference (these are default):

[centos7]# cat /etc/logrotate.d/syslog 
/var/log/cron
/var/log/maillog
/var/log/messages
/var/log/secure
/var/log/spooler
{
    missingok
    sharedscripts
    postrotate
	/bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null || true
    endscript
}
[alma8]# cat /etc/logrotate.d/syslog 
/var/log/cron
/var/log/maillog
/var/log/messages
/var/log/secure
/var/log/spooler
{
    missingok
    sharedscripts
    postrotate
        /usr/bin/systemctl kill -s HUP rsyslog.service >/dev/null 2>&1 || true
    endscript
}
[alma9]# cat /etc/logrotate.d/rsyslog
/var/log/cron
/var/log/maillog
/var/log/messages
/var/log/secure
/var/log/spooler
{
    missingok
    sharedscripts
    postrotate
        /usr/bin/systemctl kill -s HUP rsyslog.service >/dev/null 2>&1 || true
    endscript
}

Note that the file is renamed (syslog->rsyslog) in el9.

Therefore, the OP file (apart from compress) looks ok (unless there are unprintable non-ASCII chars in it).

What is wrong with having compress?

I can’t see a problem with compress, the default samba file on my 8.7 machine is:

/var/log/samba/log.* {
    compress
    dateext
    maxage 180
    rotate 10
    notifempty
    olddir /var/log/samba/old
    missingok
    copytruncate
}

ok thank you
Seems a little more changed between centos7 and alma8 than what i found.
I have a file named .syslog.swp
and get this error unknown option ‘b’ – ignoring line
there is only one line in that file.
Is it needed with alma 8?

Config files are either from packages or created by user.
If you had created it intentionally, then you would know. Presumably.

I would ask, is the file from a package?

rpm -qf /etc/logrotate.d/.syslog.swp

I’d guess it is not, but a temporary created by the 7->8 conversion that was not cleaned out.

1 Like

I believe you are correct

Here is the error that keeps showing up.
/etc/cron.daily/logrotate:

error: syslog:1 lines must begin with a keyword or a filename (possibly in double quotes)
error: syslog:2 lines must begin with a keyword or a filename (possibly in double quotes)
error: /etc/logrotate.conf:21 duplicate log entry for /var/log/wtmp
logrotate_script: $‘\r’: command not found

This is what’s in cron daily logrotate

/usr/sbin/logrotate /etc/logrotate.conf
EXITVALUE=$?
if [ $EXITVALUE != 0 ]; then
/usr/bin/logger -t logrotate “ALERT exited abnormally with [$EXITVALUE]”
fi
exit $EXITVALUE

This is in logrotate.d/syslog
[alma8] # cat /etc/logrotate.d/syslog
/var/log/cron
/var/log/maillog
/var/log/messages
/var/log/secure
/var/log/spooler
{
compress
dateext
missingok
sharedscripts
postrotate
/usr/bin/systemctl kill -s HUP rsyslog.service >/dev/null 2>&1 || true
endscript
}

someone’s been editing files on windows (actually probably mac?) you could run dos2unix or or sed -i 's/\r$//' on /etc/logrotate.conf

That is not even in the /ect/logrotate.conf

I would run:

file /etc/logrotate.conf /etc/logrotate.d/*

On my systems all those files are “ASCII text”. I’d expect ‘file’ say something else, if newlines are of Win or OSX type.

1 Like

On an 8.7 system:

$ vi nix
$ unix2dos -n  nix win
$ file *
nix: ASCII text
win: ASCII text, with CRLF line terminators

HTH.

/etc/logrotate.d/syslog:                 ASCII text, with CRLF line terminators

It was edited in config server Explorer
and again in a ASCII verifier.
Can’t seem to get rid of that with CRLF line terminators
on alma 8.7

@MartinR did use unix2dos to create a file with CRLF line terminators.
There should be dos2unix command to do the opposite.

I have opened a file into emacs and somehow managed to change encoding within that editor and similarly vim ought to have such function.


If you don’t have the dos2unix installed, then find out which package to install with:

dnf provides *bin/dos2unix

sed -i 's/\r$// worked on the etc/logrotate.d/syslog

1 Like