topic Re: Syslog error in Operating System - HP-UX

Syslog error

Achilles_2 — Mon, 13 Aug 2007 04:05:37 GMT

Hi there,

Any experts encountered the following problems in HP server model rx4640 and under 11.23 OS:

1) Every line is printed out twice in the syslog.log? (See the attached file)
2) The output of machinfo command shows:
model string = "ia64 hp server"
I ran the command in other rx4640, it prints:
model string = "ia64 hp server rx1600"

Will they harm the system/machine? Do anyone explain me those situtions?

Thanks

Re: Syslog error

Steven E. Protter — Mon, 13 Aug 2007 04:40:26 GMT

Shalom,

1.) I've checked your syslog and its only the lat few lines that are duplicated. I'd suggest stopping and starting the syslog daemon.

2.) This issue suggests that your system was possibly cloned using Ignite from an rx1600 system. I hope not, because this could be the cause of big problems.

model
uname -a
swlist -l product | grep -i core

Please post the output.

SEP

Re: Syslog error

Achilles_2 — Mon, 13 Aug 2007 05:08:47 GMT

Hi Steven,

My typing mistake, here is the correct one:

2) The output of machinfo command shows:
model string = "ia64 hp server"
I ran the command in other rx4640, it prints:

model string = "ia64 hp server rx1600" ====> model string = "ia64 hp server rx4640"

Thanks

Re: Syslog error

Achilles_2 — Mon, 13 Aug 2007 05:09:22 GMT

Hi Steven,

My typing mistake, here is the correct one:

2) The output of machinfo command shows:
model string = "ia64 hp server"
I ran the command in other rx4640, it prints:
model string = "ia64 hp server rx1600" ====> model string = "ia64 hp server rx4640"

Thanks

Re: Syslog error

Matti_Kurkela — Mon, 13 Aug 2007 05:18:22 GMT

SEP: please check again. Sendmail's messages are not duplicated, but everything else is.

Achilles:
Please examine your /etc/syslog.conf file. You probably have two configuration lines that define "syslog.log" as the log destination in that file.

If the facility & severity settings on those lines are defined so that some log messages can match both of those lines, these messages will get logged twice into the syslog.log file.

When the syslog daemon goes through the configuration to find a destination for each log message, it will not stop after finding the first match. This makes it possible to store some log messages both locally *and* in a remote logserver, or to send critical messages to console or to logged-in users *in addition* to logging them to normal log destination.

Unfortunately, the syslog daemon is not smart enough to remove duplicate log destinations.

If you're uncertain about your /etc/syslog.conf configuration, please show us the file.

MK

Re: Syslog error

Torsten. — Tue, 14 Aug 2007 06:37:24 GMT

To fix the model string, see

http://docs.hp.com/en/A6961-96013/ch04s12.html