Error: syslog:1 lines must begin with a keyword or a filename

Support
1

Not sure why this keeps coming up,
I upgraded centos 7 to Alma linux and now i have nothing but issues with syslog.

2

thatā€™ll be a logrotate error.

have a look at the first line of /etc/logrotate.d/syslog - make sure you havenā€™t been editing the file using windows

3

This is what is in that file
/var/log/cron
/var/log/maillog
/var/log/messages
/var/log/secure
/var/log/spooler
{
compress
missingok
sharedscripts
postrotate
/usr/bin/systemctl kill -s HUP rsyslog.service >/dev/null 2>&1 || true
endscript
}

4

For reference (these are default):

[centos7]# cat /etc/logrotate.d/syslog 
/var/log/cron
/var/log/maillog
/var/log/messages
/var/log/secure
/var/log/spooler
{
    missingok
    sharedscripts
    postrotate
	/bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null || true
    endscript
}

[alma8]# cat /etc/logrotate.d/syslog 
/var/log/cron
/var/log/maillog
/var/log/messages
/var/log/secure
/var/log/spooler
{
    missingok
    sharedscripts
    postrotate
        /usr/bin/systemctl kill -s HUP rsyslog.service >/dev/null 2>&1 || true
    endscript
}

[alma9]# cat /etc/logrotate.d/rsyslog
/var/log/cron
/var/log/maillog
/var/log/messages
/var/log/secure
/var/log/spooler
{
    missingok
    sharedscripts
    postrotate
        /usr/bin/systemctl kill -s HUP rsyslog.service >/dev/null 2>&1 || true
    endscript
}

Note that the file is renamed (syslog->rsyslog) in el9.

Therefore, the OP file (apart from compress) looks ok (unless there are unprintable non-ASCII chars in it).

5

What is wrong with having compress?

6

I canā€™t see a problem with compress, the default samba file on my 8.7 machine is:

/var/log/samba/log.* {
    compress
    dateext
    maxage 180
    rotate 10
    notifempty
    olddir /var/log/samba/old
    missingok
    copytruncate
}
7

ok thank you
Seems a little more changed between centos7 and alma8 than what i found.
I have a file named .syslog.swp
and get this error unknown option ā€˜bā€™ ā€“ ignoring line
there is only one line in that file.
Is it needed with alma 8?

8

Config files are either from packages or created by user.
If you had created it intentionally, then you would know. Presumably.

I would ask, is the file from a package?

rpm -qf /etc/logrotate.d/.syslog.swp

Iā€™d guess it is not, but a temporary created by the 7->8 conversion that was not cleaned out.

1 Like
9

I believe you are correct

10

Here is the error that keeps showing up.
/etc/cron.daily/logrotate:

error: syslog:1 lines must begin with a keyword or a filename (possibly in double quotes)
error: syslog:2 lines must begin with a keyword or a filename (possibly in double quotes)
error: /etc/logrotate.conf:21 duplicate log entry for /var/log/wtmp
logrotate_script: $ā€˜\rā€™: command not found

This is whatā€™s in cron daily logrotate

/usr/sbin/logrotate /etc/logrotate.conf
EXITVALUE=$?
if [ $EXITVALUE != 0 ]; then
/usr/bin/logger -t logrotate ā€œALERT exited abnormally with [$EXITVALUE]ā€
fi
exit $EXITVALUE

This is in logrotate.d/syslog
[alma8] # cat /etc/logrotate.d/syslog
/var/log/cron
/var/log/maillog
/var/log/messages
/var/log/secure
/var/log/spooler
{
compress
dateext
missingok
sharedscripts
postrotate
/usr/bin/systemctl kill -s HUP rsyslog.service >/dev/null 2>&1 || true
endscript
}

11

someoneā€™s been editing files on windows (actually probably mac?) you could run dos2unix or or sed -i 's/\r$//' on /etc/logrotate.conf

12

That is not even in the /ect/logrotate.conf

13

I would run:

file /etc/logrotate.conf /etc/logrotate.d/*

On my systems all those files are ā€œASCII textā€. Iā€™d expect ā€˜fileā€™ say something else, if newlines are of Win or OSX type.

1 Like
14

On an 8.7 system:

$ vi nix
$ unix2dos -n  nix win
$ file *
nix: ASCII text
win: ASCII text, with CRLF line terminators

HTH.

15 
/etc/logrotate.d/syslog:                 ASCII text, with CRLF line terminators

It was edited in config server Explorer
and again in a ASCII verifier.
Canā€™t seem to get rid of that with CRLF line terminators
on alma 8.7

16

@MartinR did use unix2dos to create a file with CRLF line terminators.
There should be dos2unix command to do the opposite.

I have opened a file into emacs and somehow managed to change encoding within that editor and similarly vim ought to have such function.

If you donā€™t have the dos2unix installed, then find out which package to install with:

dnf provides *bin/dos2unix
17

sed -i 's/\r$// worked on the etc/logrotate.d/syslog

1 Like