topic Re: /var/adm/syslog/mail.log & syslog.log file problem in Operating System - HP-UX

/var/adm/syslog/mail.log & syslog.log file problem

roobala — Tue, 28 Nov 2000 11:51:54 GMT

Dear All
HP 9000 L-1000 HPUX 11.00 Server working as a mail server Sendmail 8.8.6.

When we see today the
/var/adm/syslog/mail.log and /var/adm/syslog/syslog.log files are 0 bytes in size and the last time and date of modification is 27th November 12.30

There was no information how these 2 files became 0 bytes.

One more thing is if at all somebody made those files to 0 bytes by this time those files should grow(more than 30 hours over) but till now 2 files are 0 bytes. Mails are going without any problem

who -r gives some exciting output which I suspect , it may help to resolve this problem (See the attachment)

How to make the system to start log (mail.log and syslog.log).

Please help us to solve this issue

Thanks in Advance

Roobala

Re: /var/adm/syslog/mail.log & syslog.log file problem

CHRIS_ANORUO — Tue, 28 Nov 2000 12:17:14 GMT

Hi roobala,

Check your crontab file to see if you have a command that will reduce files to zero form disk house keeping. (crontab -l). Look for a line like:
cat /dev/null > /var/adm/syslog/mail.log or syslog.log. This will zero the large files at 12:30 on the specified day in your cron file.

Re: /var/adm/syslog/mail.log & syslog.log file problem

Kofi ARTHIABAH — Tue, 28 Nov 2000 12:17:44 GMT

To resume logging, you may have to restart sendmail and syslogd since the two programs seem not to be in "connection" with their log files.

# /sbin/init.d/sendmail stop ; /sbin/init.d/sendmail start
# /sbin/init.d/syslog stop ; /sbin/init.d/syslog start

Re: /var/adm/syslog/mail.log & syslog.log file problem

roobala — Tue, 28 Nov 2000 12:22:23 GMT

Hi,

I already verified , there was no crontab entry as U said.
I can confirm this is not because of crontab

Roobala

Re: /var/adm/syslog/mail.log & syslog.log file problem

Kofi ARTHIABAH — Tue, 28 Nov 2000 12:50:32 GMT

I believe if the files were deleted by a user, the user would have had to have root equivalence.

I would suggest searching each users' .sh_history file for any tell tale signs.

Re: /var/adm/syslog/mail.log & syslog.log file problem

Matjaz Obstetar — Wed, 29 Nov 2000 09:18:53 GMT

Hi,

/etc/syslog.conf is a configuration file for syslog deamon. What is logging with syslog deamon is writen in this file. You should check if there is any entry about syslog.log and mail.log.

Default entries about mail.log and syslog.log are:

mail.debug /var/adm/syslog/mail.log

*.info;mail.none /var/adm/syslog/syslog.log