2

I have a host running rsyslog which uses imuxsock to accept messages from journald. However, during boot, after rsyslog is started, it is restarted (stopped and started) again by systemd. I need to know why systemd did this.

How can we know what caused systemd to restart a service ? (in this case, it was soon after initial start)

I am facing an issue where for the time difference of a minute or so between journald start and rsyslog start, i only see kernel messages in rsyslog (and no user-space messages). However, after rsyslog start time, user-space messages are also seen. I guess the unexpected restart may have something to with this.

I have "Restart=on-failure" in the service file.

Here are the logs from my host which don't provide a clue for the cause of restart.

host_1:/home/admin# journalctl -u rsyslog --no-pager -- Logs begin at Thu 2019-10-24 15:01:58 UTC, end at Thu 2019-10-24 17:20:37 UTC. -- Oct 24 15:03:25 host_1 rsyslogd[5332]: environment variable TZ is not set, auto correcting this to TZ=/etc/localtime [v8.36.0 try http://www.rsyslog.com/e/2442 ] Oct 24 15:03:25 host_1 rsyslogd[5332]: imuxsock: Acquired UNIX socket '/run/systemd/journal/syslog' (fd 3) from systemd. [v8.36.0] Oct 24 15:03:25 host_1 rsyslogd[5332]: [origin software="rsyslogd" swVersion="8.36.0" x-pid="5332" x-info="http://www.rsyslog.com"] start Oct 24 15:03:25 host_1 systemd[1]: Starting System Logging Service... Oct 24 15:03:25 host_1 systemd[1]: Started System Logging Service. Oct 24 15:03:26 host_1 systemd[1]: Stopping System Logging Service... Oct 24 15:03:26 host_1 rsyslogd[5332]: [origin software="rsyslogd" swVersion="8.36.0" x-pid="5332" x-info="http://www.rsyslog.com"] exiting on signal 15. Oct 24 15:03:26 host_1 systemd[1]: Stopped System Logging Service. Oct 24 15:03:26 host_1 systemd[1]: Starting System Logging Service... Oct 24 15:03:26 host_1 rsyslogd[6201]: environment variable TZ is not set, auto correcting this to TZ=/etc/localtime [v8.36.0 try http://www.rsyslog.com/e/2442 ] Oct 24 15:03:26 host_1 systemd[1]: Started System Logging Service. Oct 24 15:03:26 host_1 rsyslogd[6201]: imuxsock: Acquired UNIX socket '/run/systemd/journal/syslog' (fd 3) from systemd. [v8.36.0] Oct 24 15:03:26 host_1 rsyslogd[6201]: [origin software="rsyslogd" swVersion="8.36.0" x-pid="6201" x-info="http://www.rsyslog.com"] start
Improve this question

1 Answer 1

Reset to default
1

Similar mistery on my side. I have a service (Java application as a Systemd unit) which runs OK for some days. Suddenly today it was restarted. In journaldctl I see only these logs at restart time:

Stopping foobar.service - foobar service... Stopped foobar.service - foobar service. foobar.service: Consumed 6min 25.495s CPU time, 184.7M memory peak, 0B memory swap peak. Starting foobar.service - foobar service... Started foobar.service - foobar service.

This happened on Ubuntu 24.04.1 LTS.

UPDATE: after more digging I found that this restart was part of more restarts done by Systemd and it all started with this:

systemd[1]: Starting apt-daily-upgrade.service - Daily apt upgrade and clean activities...

Apparently this is some upgrading process. The primary cause are timers: apt-daily.timer and apt-daily-upgrade.timer which are configured by default on Ubuntu.

These timers can be disabled and stopped:

sudo systemctl disable apt-daily.timer sudo systemctl disable apt-daily-upgrade.timer sudo systemctl stop apt-daily.timer sudo systemctl stop apt-daily-upgrade.timer

Final thought: to discover a restart reason for a service one have to look at logs of all services at some time before your service was restarted. Sample command to find such logs based on dates:

journalctl --since "2025-02-06 06:35" --until "2025-02-06 06:45"
Improve this answer

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.