topic Re: syslogd terminated in Operating System - HP-UX

syslogd terminated

atul2701 — Wed, 11 May 2011 11:37:00 GMT

Hi

When i am trying to start the syslogd on my HP UX B.11.31 server it start and terminated immediately. I have tried to replace the /etc/syslog.conf file with /usr/newconfig/etc/syslog.conf.

# ps -ef |grep -i syslog
root 9925 11167 1 06:33:40 pts/0 0:00 grep -i syslog
# /sbin/init.d/syslogd stop
syslogd stopped
# /sbin/init.d/syslogd start
System message logger started
# tail /var/adm/syslog/syslog.log
May 11 06:33:58 whqwm03 syslogd: restart
May 11 06:33:58 whqwm03 syslogd: the kernel messages are already disabled: No such device or address
# cat /var/run/syslog.pid
10171
# ps -ef |grep -iE "10171|syslog"
root 10914 11167 0 06:35:01 pts/0 0:00 grep -iE 10171|syslog
#

Re: syslogd terminated

Mel Burslan — Wed, 11 May 2011 13:12:09 GMT

Long, long time ago, I remember encountering a situation like this and the cause of mine being ended up whitespaces in the syslog.conf file instead of tabs. Field separators in syslog.conf file SHOULD BE s, NOT whitespaces.

when you said you copied the newconfig file, you just cat'ed the file and do a screen-scraping (click and drag highlight and copy) then paste into your editor session, what you might end up doing is introducing whitespaces.

If I were you, even if you did not do what I said, I'd check for the existence of whitespaces in this file. Just for precaution if nothing else.

Re: syslogd terminated

Michael Steele_2 — Wed, 11 May 2011 15:56:06 GMT

I believe you are on the right track with /usr/newconfig/etc/syslog.conf but I must believe that you have a whitespace or control char still in there.

Question: Did you update the default syslog.conf file or just copy it in?

b) try this

grep -v "^[[:blank:]]*$" syslog.conf > work_file
ls -la both files
cksum both files

Any difference? If so then use the work_file

Re: syslogd terminated

atul2701 — Thu, 12 May 2011 07:07:45 GMT

no luck...

# cd /etc
# grep -v "^[[:blank:]]*$" syslog.conf > work_file
# ls -la syslog.conf
-r--r--r-- 1 bin bin 250 May 12 01:30 syslog.conf
# ls -la work_file
-rw-r----- 1 root sys 250 May 12 01:47 work_file
# cksum syslog.conf work_file
3145885767 250 syslog.conf
3145885767 250 work_file

Re: syslogd terminated

atul2701 — Thu, 12 May 2011 07:14:59 GMT

Re: syslogd terminated

Laurent Menase — Thu, 12 May 2011 08:48:02 GMT

do you have any 3rd party pam or nss lib?
is there a core?

you can also try a tusc on it to see what it is doing.

Re: syslogd terminated

Duncan Edmonstone — Thu, 12 May 2011 09:03:49 GMT

Michael,

>> grep -v "^[[:blank:]]*$" syslog.conf > work_file

I don't think that regexp is working as you expected - I just added some spaces to a copy of my syslog.conf file and ran it through it, and it didn't pick them up...

atgupta,

Maybe a simpler one, does:

grep ' ' /etc/syslog.conf

(that's a space between the quote ' symbols)

return anything that's not on a comment line?

HTH

Duncan

Re: syslogd terminated

atul2701 — Thu, 12 May 2011 11:47:38 GMT

Laurent@ bad luck tusc or any other utility is not installed..

Duncan@ grep " " /etc/syslog.conf i already tried and there was no space...

# grep ' ' /etc/syslog.conf
# @(#)B.11.31_LR
# syslogd configuration file.
# See syslogd(1M) for information about the format of this file.
#

Re: syslogd terminated

Michael Steele_2 — Thu, 12 May 2011 12:04:25 GMT

Well, I have to believe that this is for information only. Try running some LVM commands like:

vgscan -p -v -a
lvlnboot -R

...and post syslog.log afterwards.

Re: syslogd terminated

atul2701 — Thu, 12 May 2011 12:41:24 GMT

As syslogd terminated immediately after i start it hence its not loging anything in syslog.log...

Re: syslogd terminated

Michael Steele_2 — Thu, 12 May 2011 13:19:01 GMT

What are the error messages from dmesg?
What are the error messages on the console?

Re: syslogd terminated

Mel Burslan — Thu, 12 May 2011 14:24:24 GMT

Just for the kick, instead of starting syslogd, using the init script, what happens if you start it directly from the command line as in

/usr/sbin/syslogd

without putting it in background (i.e. daemon mode) is it staying up or dying down immediately ?

Open another terminal window to the same system and run:

while true; do
ps -ef | grep syslogd
done

continuously. This will impact the performance more than likely. So, if this is a production system, you might want to do it after hours. Also capture the terminal session as the output will most probably flow too fast for your eyes to catch anything meaningful.

This may give you a bit more insight and won't hurt anything just by trying.

Just a thought

Re: syslogd terminated

Laurent Menase — Thu, 12 May 2011 18:41:30 GMT

try to start /usr/sbin/syslogd -d

Re: syslogd terminated

atul2701 — Fri, 13 May 2011 05:47:16 GMT

all above things i have already tried and no luck..

when it dies its creating the core file..
# what core
core:
$ PATCH_11.31/PHCO_39177 May 21 2009 06:51:02 $
$ PATCH_11.31/PHCO_40292 Jul 6 2010 09:44:47 $
92453-07 linker dld HP Itanium(R) B.12.55
92453-07 linker uld HP Itanium(R) B.12.55
#

Re: syslogd terminated

atul2701 — Fri, 13 May 2011 11:40:07 GMT

Thanks all for your valuable time and support.. Finaly i got the solution.

Under syslog dir mail.log file size was 2Gb. i have trimmed the same and after that start the syslogd daemon and running fine..

Atul

Re: syslogd terminated

Ismail Azad — Fri, 13 May 2011 16:32:44 GMT

Hey atgupta,

Well I guess the moral of this scenario turns out to be trimming certain stuff once in a while on the /var filesystem... Be it the syslog, or let's say the wtmps or btmps file. That's why on a server that you consider important it's momentous to check if the /var is reaching let's say 98% with very less free space left.

Regards
Ismail Azad

Re: syslogd terminated

atul2701 — Mon, 16 May 2011 05:46:28 GMT

Its not bcoz /var fs is running out of space. /var utilization was around 58% only.

there is a bug in 11.31 Syslogd is checking or calling mail.log. That’s the reason need to trim down some files with near or greater than 2GB or modifying the LOG_SIZE=NOLIMIT in /etc/defaults/syslogd file.