topic Re: syslog.log in Operating System - HP-UX

syslog.log

chad_c — Tue, 30 Oct 2007 17:45:28 GMT

hi....we have an hpux11.11 4440 server.

in the syslog.log we noticed the following entry occurring several times per second.

txovo remshd[280]: wtmp:open: /var/adm/wtmp No such file or directory

we deleted the /var/adm/wtmp file a while back because we did not require it to log info.

is there a way to prevent the following entry from being logged in the syslog.log file

txovo remshd[280]: wtmp:open: /var/adm/wtmp No such file or directory

rgds,
chad

Re: syslog.log

Court Campbell — Tue, 30 Oct 2007 19:39:23 GMT

For this particular entry you need to edit inetd.conf and change the line

shell stream tcp nowait root /usr/lbin/remshd remshd

shell stream tcp nowait root /usr/lbin/remshd remshd -t

then you need to run inetd -c

Re: syslog.log

whiteknight — Tue, 30 Oct 2007 20:18:29 GMT

Hi Chad,

Please also patch this as well.

PHNE_33793 11.11 r-commands cumulative mega-patch

it fixed known issues

WK

Re: syslog.log

chad_c — Wed, 31 Oct 2007 10:00:53 GMT

hi...thanks for the info.

i made the changes to the suggested file

shell stream tcp nowait root /usr/lbin/remshd remshd -t

then ran: txovo# inetd -c

still getting: Oct 31 09:59:04 txovo remshd[1162]: wtmp:open: /var/adm/wtmp No such file or directory

any idea on how to prevent this entry from being logged to syslog.log?

rgds,
chad

Re: syslog.log

Patrick Wallek — Wed, 31 Oct 2007 10:21:17 GMT

How about just recreateing /var/adm/wtmp?

The file usually does not get very large, if it does you can clean it up.

Re: syslog.log

Court Campbell — Wed, 31 Oct 2007 10:22:12 GMT

Not sure why it did not work, but you could always recreate the file /var/adm/wtmp. I am not sure why you removed it in the forst place, and I don't really need an explanation.

Re: syslog.log

chad_c — Wed, 31 Oct 2007 10:35:55 GMT

i could recreate wtmp, but we have several servers that remsh to this box very frequently which creates an entry in the wtmp file. this fills up the lvol very fast. so i deleted it. this however causes the syslog.log to log an entry saying it cannot find wtmp which causes the lvol to fill pretty fast.

so i'm just looking for a way to not log the following entry in the syslog.log

Oct 31 10:33:05 txovo remshd[445]: wtmp:open: /var/adm/wtmp No such file or directory

rgds,
chad

Re: syslog.log

Court Campbell — Wed, 31 Oct 2007 10:57:57 GMT

add the file back and if it is really growing that fast write a script that wipes the file via cron every so often.

Re: syslog.log

Patrick Wallek — Wed, 31 Oct 2007 11:02:26 GMT

What if you link /var/adm/wtmp to /dev/null?

# cd /var/adm
# umask 000
# ln -s /dev/null wtmp
(Don't forget to reset your umask)

This may fool the system into thinking wtmp is there, but when it writes something to wtmp, it gets tossed to /dev/null and doesn't cost you any disk space.

Re: syslog.log

rajdev — Wed, 31 Oct 2007 11:06:06 GMT

Hi Chad,

you can try this if you don't want the error to go to syslog.

1) take back of inetd.conf

2) modify the line

shell stream tcp6 nowait root /usr/lbin/remshd remshd

TO

shell stream tcp6 nowait root /usr/lbin/remshd>/dev/null remshd

3) run inetd -c

4) now try the remsh from other hosts

Regards

Re: syslog.log

chad_c — Wed, 31 Oct 2007 11:20:45 GMT

patrick,

sounds like it may work....before i try it, want to make sure i know what you mean you you say (Don't forget to reset your umask)

rgds,
chad

Re: syslog.log

Patrick Wallek — Wed, 31 Oct 2007 11:33:25 GMT

In the command I gave, I have you do a 'umask 000'. This sets your umask to 0 and causes the permissions on the link created to be 777.

After you create the link you just need to reset your umask to whatever it was before you ran 'umask 000' so that any new files that are created are created with the correct permissions based on your umask.

Re: syslog.log

chad_c — Wed, 31 Oct 2007 11:40:34 GMT

Re: syslog.log

Court Campbell — Wed, 31 Oct 2007 12:03:41 GMT

Kudos Pat.