topic Re: Syslog.log not logging anymore ... in Operating System - HP-UX

Syslog.log not logging anymore ...

Chushia — Mon, 05 Jun 2006 09:51:57 GMT

On Friday one of my colleague ran a program at background that required passwd. He didn't notice this so the program ran with extensive tmp file in /var over the weekend filling up the file system /var. After we killed the program, the space it took on /var were released. All went well ever since except, /var/adm/syslog/syslog.log, mail.log, wtmp, btmp all stopped logging.

How can I make them work again ? I hope not to reboot the server.

Thanks,
Chushia

Re: Syslog.log not logging anymore ...

A. Clay Stephenson — Mon, 05 Jun 2006 09:59:41 GMT

/sbin/init.d/syslogd start

Re: Syslog.log not logging anymore ...

Patrick Wallek — Mon, 05 Jun 2006 10:00:49 GMT

For syslog:

# /sbin/init.d/syslogd stop
# /sbin/init.d/syslogd start

For mail.log:

# /sbin/init.d/sendmail stop
# /sbin/init.d/sendmail start

wtmp and btmp should start logging again automatically.

Re: Syslog.log not logging anymore ...

DCE — Mon, 05 Jun 2006 10:03:05 GMT

Chusia,
the first thing you should do is stop/start the syslogd daemon

There are several ways to stop/start the syslog daemon listed in the man page for syslogd

I prefer to issue the commands

/sbin/init.d/syslogd stop
/sbin/init.d/syslogd start

to stop/start the daemon

Re: Syslog.log not logging anymore ...

Chushia — Mon, 05 Jun 2006 10:13:05 GMT

Thanks, A.Clay, Patrick and DCE.
Now syslog and mail log are all functioning.

For wtmp and btmp, I can see the time stamp did show current. But "last" command didn't show any new login information. How to fix this, please ?

Thanks,
Chushia

Re: Syslog.log not logging anymore ...

A. Clay Stephenson — Mon, 05 Jun 2006 10:35:16 GMT

/var/adm/wtmp almost certainly is corrupt. You need to use fwtmp to output the file in ASCII mode to a text file and then remove any bogus entries and then use fwtmp agin to read your edited file and output in binary format. Man fwtmp and wtmpfix for details.

Re: Syslog.log not logging anymore ...

Mridul Shrivastava — Mon, 05 Jun 2006 10:36:55 GMT

When pcnfsd receives a PCNFSD_AUTH or PCNFSD2_AUTH
request, it will "log in" the user by validating the
user name and password, returning the corresponding
user ID, group IDs, home directory, and umask. It
will also append a record to the wtmp data base
(see wtmp(4)). If you do not want PC "logins"
recorded in this way, add a line to the /etc/pcnfsd.conf
file in the form:

wtmp off

Re: Syslog.log not logging anymore ...

Greg Vaidman — Mon, 05 Jun 2006 10:40:35 GMT

try /usr/sbin/acct/startup to reactivate writing to wtmp file...

Re: Syslog.log not logging anymore ...

Chushia — Mon, 05 Jun 2006 11:06:31 GMT

Thanks A. Clay!

The wtmp file is corrupted.
I used fwtmp to translate the file to ASCII to edit and then fwtmp to translate it back to wtmp format. Now the "last" gives account information ...

Greatly appreciated!
Chushia