topic Re: syslogd in Operating System - HP-UX

syslogd

Leon Smith, Jr — Wed, 11 Jul 2007 10:12:47 GMT

I am running 11.11 and just applied B.11.11.0706.467 Base Patches for HP-UX 11i v1, June 2007. when the server came back up I noticed / at 100% so I cleared out some useless files and brought it down to 77% the last entry in the sylog was about vx-nospace on rootvol and that was 3 days ago. I have bounced it several times and tested it with logger but still no updates. Please advise.

Re: syslogd

Court Campbell — Wed, 11 Jul 2007 10:21:08 GMT

When you say "bounce", do you mean the server or syslogd? Is /var full by chance? If you bounced syslogd, what steps did you use?

Re: syslogd

Leon Smith, Jr — Wed, 11 Jul 2007 10:39:42 GMT

I bounced it by first by killing syslogd -D pid then starting it with /sbin/init.d/syslogd start. after that I logger test and nothing.

Re: syslogd

Ivan Krastev — Wed, 11 Jul 2007 10:41:40 GMT

When /var is full syslogd cannot write and after clean up you need to restart it.

regards,
ivan

Re: syslogd

Leon Smith, Jr — Wed, 11 Jul 2007 10:44:15 GMT

Var is at 63%

Re: syslogd

Sudalaimani — Wed, 11 Jul 2007 10:48:22 GMT

Hi,

1. Look for any "core" files in the root FS, some times applications running as root will put core file, when it have issues
2. Verify all the FS which has other than root ownnership, are mounted ,If it is not mounted, the user will fill dir. which is sitting on the root FS.
3. Verify the entries under /etc/vlmconf - if you have too many VG's you may plan to move the *.old files to other location for temporarily
3. If you have "lsof" run it and collect the output in file and check the process size on FS- sometimes the process initiated from root FS will
temprarily use the root FS for its space requirement.

Finally you may consider extending the root FS, (online if you have using mirroring)

Hope this helps a bit

Re: syslogd

Leon Smith, Jr — Wed, 11 Jul 2007 11:01:18 GMT

My problem is not with the rootvol but with syslogd.

Re: syslogd

Court Campbell — Wed, 11 Jul 2007 11:51:48 GMT

try this:

# ps -ef | grep syslogd

see if it is even running. if not, then see if the file /var/run/syslog.pid exists and remove it. then try and start syslogd again.

Re: syslogd

Leon Smith, Jr — Wed, 11 Jul 2007 12:53:51 GMT

syslog is running but not logging.

Re: syslogd

David Child_1 — Wed, 11 Jul 2007 14:49:23 GMT

You didn't mention modifying /etc/syslog.conf so this is probably a long shot, but...

Make sure that there aren't any entries using spaces instead of tabs. That will stop syslog from working correctly.

Perhaps when / filled up it corrupted /etc/syslog.conf.

It's worth a quick check.

David

Re: syslogd

skt_skt — Wed, 11 Jul 2007 22:00:50 GMT

do a lsof>lsof.out and see how many syslog.log is locked. Comapare with a working one.

what is the syslogd cuulative patch you have.