Syslog is not logging activity

[Lisa Moore]

Apparently /var/adm/syslog/syslog.log is not being reported to. What would have caused this and how do I fix it??

[Bill McNAMARA_1 · Accepted solution]

Check your /etc/syslog.conf:


# @(#) $Revision: 74.1 $
#
# syslogd configuration file.
#
# See syslogd(1M) for information about the format of this file.
#
mail.debug /var/adm/syslog/mail.log
*.info;mail.none /var/adm/syslog/syslog.log
*.alert /dev/console
*.alert root
*.emerg *


Check the process:
# ps -ef | grep syslog
root 476 1 0 Aug 5 ? 0:00 /usr/sbin/syslogd -D
root 14055 12565 1 14:21:33 ttyp3 0:00 grep syslog

and restart if necessary:
# /sbin/init.d/syslogd
usage: /sbin/init.d/syslogd {start|stop}

Later,
Bill

[harry d brown jr]

Check to see if syslogd is running. get "lsof" (below is link) and check if the syslog.log file is open.

http://hpux.cs.utah.edu/hppd/hpux/Sysadmin/lsof-4.64/

live free or die
harry

[Jeff Schussele]

Hi Lisa,

You should bounce the syslogd daemon.
Find the PID using
#ps -ef | grep syslog
then kill HUP it
#kill -HUP xxxx
where xxxx is the PID reported in the ps command.
This is not uncommon for the syslog daemon to "hang" like this.

HTH,
Jeff

[Santosh Nair_1]

Another possibility if syslogd is running is that someone edited/emptied the syslog file while syslog had the file open. Try sending a HUP signal to the syslog process, i.e. kill -HUP $(cat /var/run/syslog.pid).

Also, you can try using logger to send something to syslog.

-Santosh

[Lisa Moore]

I tried the first suggestion, but there is no syslog process running. Please review the output and advise. THANKS!!

finance:/etc#cat syslog.conf
# @(#) $Revision: 74.1 $
#
# syslogd configuration file.
#
# See syslogd(1M) for information about the format of this file.
#
mail.debug /var/adm/syslog/mail.log
*.info;mail.none /var/adm/syslog/syslog.log
*.alert /dev/console
*.alert root
*.emerg *
finance:/etc#ps -ef | grep syslog
root 13577 7004 1 09:20:14 pts/tb 0:00 grep syslog
finance:/etc#/sbin/init.d/syslogd
usage: /sbin/init.d/syslogd {start|stop}
finance:/etc#ps -ef | grep syslog
root 13580 7004 1 09:20:45 pts/tb 0:00 grep syslog
finance:/etc#cd
finance:/#/sbin/init.d/syslogd
usage: /sbin/init.d/syslogd {start|stop}
finance:/#ps -ef | grep syslog
root 13583 7004 0 09:21:00 pts/tb 0:00 grep syslog
finance:/#

[Santosh Nair_1]

To bring up syslogd, do the following:

/sbin/init.d/syslogd start

Note the start parameter at the end.

-Santosh

[Hai Nguyen_1]

Lisa,

Your syslogd is not running. To start it, run:

# /sbin/init.d/syslogd start

Then check with:

# ps -ef | grep syslogd

You should see it up and running.

Your /etc/syslog.conf looks fine.

Hai

[Lisa Moore]

YOU GUYS ARE THE GREATEST!!!

Thank you sooooo much!

finance:/sbin/init.d#/sbin/init.d/syslogd start
System message logger started
finance:/sbin/init.d#ps -ef | grep syslog
root 14214 1 0 09:33:26 ? 0:00 /usr/sbin/syslogd -D
root 14216 7004 0 09:33:31 pts/tb 0:00 grep syslog
finance:/sbin/init.d#more /var/adm/syslog/syslog.log
Aug 7 09:33:26 finance syslogd: restart