Skip to main content

rsyslog: imklog: Cannot open proc file system

For some time now rsyslog was not logging kern.* messages any more on this Ubuntu system:

Jul  6 18:07:08 len kernel: imklog: Cannot open proc file system, 2.
Jul  6 18:07:08 len rsyslogd: [origin software="rsyslogd" ...] (re)start
It has been upgraded from 9.10, and LP#401433 seems to suggest that some upgrade broke imklog. The fix suggested there would involve the following commands, but since my /var/run is a tmpfs, I'd have to have this executed after every reboot (and before rsyslog starts):
  mkdir -m0700 -p /var/run/rsyslog
  chown syslog:syslog /var/run/rsyslog
  mkfifo -m 600 /var/run/rsyslog/kmsg
  chown syslog:syslog /var/run/rsyslog/kmsg
  start-stop-daemon --start --pidfile /var/run/rsyslog/kmsgpipe.pid \
                    --exec /bin/dd -b -m -- if=/proc/kmsg of=/var/run/rsyslog/kmsg
The "real" fix here was to apply a bit of Windows-fu *) to this setup and reinstall rsyslog :-\

*) The three Rs of Microsoft support: Retry, Reboot, Reinstall