Linux – /var/log/messages Not Created Although restart rsyslog.service

I don't know what might be happening, but I've got a few questions that could help to debug it:

• Is rsyslogd running? (obvious, but just in case ...)
• If you execute the command "logger test", does anything appear in /var/log/syslog?
• Does /dev/log exist, with permissions for everyone to read and write? Is it a socket? ("file /dev/log")
• What happens in you stop rsyslogd and then run it with "-d"? Does it output any error? Does it output a start message to /var/log/syslog?
• Does anything change if you move the contents of /etc/rsyslog.d out of the way, and restart rsyslog just with the basic configuration?

Hope this helps.

rsyslog should re-create the file (with correct permissions)after restarting:

# mv /var/log/syslog /tmp/

# /etc/init.d/rsyslog restart
[ ok ] Restarting rsyslog (via systemctl): rsyslog.service.

# dir /var/log/syslog
-rw-r----- 1 root adm 327 Oct 27 13:28 /var/log/syslog

Perhaps try forcing a log entry to make sure it's running:

# /usr/bin/logger -p0 foo
# tail /var/log/syslog
...
Oct 27 13:31:39 myserver root: foo