topic Re: /var/adm/syslog/syslog never being written to in Operating System - HP-UX

/var/adm/syslog/syslog never being written to

Tim Killinger — Mon, 18 Oct 2004 14:43:20 GMT

I have an ux 11.0 machine whose syslog is always 0 bytes. I have other machines where various things are being written to syslog as I would expect. the /etc/syslog.conf file is identical on each machine.

What might be missing that is not allowing/creating syslog entries on this one machine??

Re: /var/adm/syslog/syslog never being written to

Steven E. Protter — Mon, 18 Oct 2004 14:46:31 GMT

The syslog daemon may not be running.

ps -ef | grep syslog

should yeild
/usr/bin/syslog -D

/sbin/init.d/syslogd start

Check the permissions on the syslog file and make sure it can be written to.

SEP

Re: /var/adm/syslog/syslog never being written to

A. Clay Stephenson — Mon, 18 Oct 2004 14:47:25 GMT

The most obvious answer is that syslogd is not running. The very first thing to do is a ps -ef | grep syslogd to see if the daemon is running.

Re: /var/adm/syslog/syslog never being written to

Geoff Wild — Mon, 18 Oct 2004 14:48:16 GMT

is the syslogd daemon running?

ps -ef |grep syslog
root 899 1 0 Sep 28 ? 00:01 /usr/sbin/syslogd -D

Check for /sbin/init.d/syslogd

and link in /sbin/rc2.d
lrwxr-xr-x 1 root root 20 Sep 23 2002 S220syslogd -> /sbin/init.d/syslogd

Rgds...Geoff

Re: /var/adm/syslog/syslog never being written to

Robert-Jan Goossens — Mon, 18 Oct 2004 14:50:56 GMT

Hi Tim,

Check the /etc/syslog.conf sometimes there are spaces instead of tabs between levels.

Best regards,
Robert-Jan

Re: /var/adm/syslog/syslog never being written to

Tim Killinger — Mon, 18 Oct 2004 15:48:26 GMT

interestingly, lsof shows 19 file open on the problem machine - machines with normal syslog entries show 20 files open... the extra file being /var/adm/syslog/syslog.log

Re: /var/adm/syslog/syslog never being written to

Bill Hassell — Mon, 18 Oct 2004 19:45:34 GMT

Did someone (as root) change permissions on /etc/syslog.conf--it should be 444 owned by bin. Also, if the file was edited incorrectly, it may invalidate the filtering. There is a clean version in /usr/newconfig/etc. See if any logging is taking place:

logger -p kern.emerg "Testing syslogd"

With a standard /etc/syslog.conf, you'll get the message in syslog and also a message on every terminal that is logged in.

If nothing happens, find syslog's PID:

ps -e | grep syslogd

If there are none, then start syslogd with:

/sbin/init.d/syslogd start

If there is one copy running, use the command:

kill -HUP

Check also that the file /var/rub/syslogd.pid has the same number as ps reports. If it does not, syslogd was probably killed accidently by a root user. Restart syslogd with:

/sbin/init.d/syslogd start

If there are multiple copies running, kill all the syslogs with:

ps -e | grep syslogd
kill -HUP ...

Check ps again to make sure all copies are gone then restart syslogd again.

You may not be up to date on patches.

Re: /var/adm/syslog/syslog never being written to

Duncan Edmonstone — Tue, 19 Oct 2004 01:50:52 GMT

If /var fills up then its not unknown for syslogd to stop writing to the syslog.log file even after space has been cleared down. Sending a kill -HUP to syslogd as suggested by Bill usually gets it going again.

HTH

Duncan

Re: /var/adm/syslog/syslog never being written to

Sยภเl Kย๓คг — Tue, 19 Oct 2004 02:06:45 GMT

1)Check wether syslogd deamon is running
#ps -aef |grep syslogd
root 393 1 0 Sep 29 ? 0:01 /usr/sbin/syslogd -D

2)Pls review /etc/syslog.conf file
it should look like

# @(#) $Revision: 74.1 $
#
# syslogd configuration file.
#
# See syslogd(1M) for information about the format of this file.
#
mail.debug /var/adm/syslog/mail.log
*.info;mail.none /var/adm/syslog/syslog.log
*.alert /dev/console
*.alert root
*.emerg *

3)check for the permission of the syslog.log
# ll /var/adm/syslog/syslog.log
-rw-r--r-- 1 root root 514756 Oct 19 11:47 /var/adm/syslog/syslog.log

regards
SK

Re: /var/adm/syslog/syslog never being written to

Tim Killinger — Tue, 19 Oct 2004 08:36:02 GMT

There was something wrong with /etc/syslog.conf. I copied the file from a machine that was working, stopped and start syslogd, and now I get syslog entries

Thanks!