System Administration
cancel
Showing results for 
Search instead for 
Did you mean: 

syslog.log suddenly not updating

n00body
Advisor

syslog.log suddenly not updating

Hi friends , i'm having problem with syslog.log . I found that it was not updating .. i restarted it and test a logger message .. it was working .. and on the next day .. I found out that the syslog.log was again stopped at the same time as the previous day .

Normally what is the possible causal that can stop syslogd from running . Thank you guys ..
11 REPLIES
Ivan Krastev
Honored Contributor

Re: syslog.log suddenly not updating

What is the size of the syslog.log file - there is a patch for files over 2GB. Check also for an additional syslog patches.

regards,
ivan
Duncan Edmonstone
Honored Contributor

Re: syslog.log suddenly not updating

What Ivan describes is 1 possibility. The other is that the filesystem that syslog.log sits in has filled (this is usually /var).

HTH

Duncan

HTH

Duncan
n00body
Advisor

Re: syslog.log suddenly not updating

Thank you guys for the reply .. he is what i found :

Filesystem kbytes used avail %used Mounted on
/dev/vg00/lvol10 512000 104814 382595 22% /var

~~~~~~~~~~~~~~~~

and this is the late entry in the syslog . I even tested with Logger .. but it wont be appended untill i restart the syslogd daemon . The weird thing is the syslog is stopped at the same time everyday .

Jan 17 06:57:56 sg1sys02 sshd[27414]: Received disconnect from 145.240.153.36: 11: Terminating connection
Jan 17 07:00:00 sg1sys02 syslog: su : + tty?? root-oracle

Jeeshan
Honored Contributor

Re: syslog.log suddenly not updating

what is the configuration of /etc/rc.config.d/syslogd file?
a warrior never quits
Torsten.
Acclaimed Contributor

Re: syslog.log suddenly not updating

Any related messages in syslog?

(the message above is from disconnecting ssh and a "su" session).

Hope this helps!
Regards
Torsten.

__________________________________________________
There are only 10 types of people in the world -
those who understand binary, and those who don't.

__________________________________________________
No support by private messages. Please ask the forum!

If you feel this was helpful please click the KUDOS! thumb below!   
n00body
Advisor

Re: syslog.log suddenly not updating

hi ahsan .. i believed you 're referring to /etc/syslogd.conf . Here is the current config
~~~~~~~~~~~~~~~~~~~~~~~~~~~

root@sg1sys02/etc # more syslog.conf
# @(#) $Revision: 74.1 $
#
# syslogd configuration file.
#
# See syslogd(1M) for information about the format of this file.
#
mail.debug /var/adm/syslog/mail.log
*.info;mail.none /var/adm/syslog/syslog.log
*.alert /dev/console
*.alert root
*.emerg *
root@sg1sys02/etc # pwd
/etc
Jeeshan
Honored Contributor

Re: syslog.log suddenly not updating

No.

i'm asking about /etc/rc.config.d/syslogd file configuration which is responsible for running the daemon.
a warrior never quits
n00body
Advisor

Re: syslog.log suddenly not updating

I couldn't find any syslogd.conf in that dir

~~~~~~~~~~~~~~~~~~~~~~
root@XXXX/ # ls /etc/rc.config.d/syslogd
/etc/rc.config.d/syslogd not found
root@XXXX/ # cd /etc/rc.config.d
root@XXXX/etc/rc.config.d # ls | grep log
root@XXXX/etc/rc.config.d # ls | grep syslog
root@XXXX/etc/rc.config.d # uname -an
HP-UX XXXX B.10.20 A 9000/889 263814391 two-user license
root@XXXX/etc/rc.config.d # model
9000/889/K460
root@XXXX/etc/rc.config.d #
Jeeshan
Honored Contributor

Re: syslog.log suddenly not updating

i didn't say syslogd.conf


I said only syslogd file
a warrior never quits
Bill Hassell
Honored Contributor

Re: syslog.log suddenly not updating

The first question is: is syslogd running when the log stops? If not, some root cronjob has killed the syslogd daemon. This is very common with badly written cron jobs that kill the wrong process ID. Look for kill commands in all cron jobs and remove any that use ps piped to grep. This is a very unstable method and root scripts can do very bad things to your system when wrong process IDs are selected.

The only sane way to find processes by name is to use the -C option, which requires the UNIX95 variable. To find just the process IDs for sh, use this:

UNIX95=1 ps -C sh -o pid=

Compare the output of the above command with the typical grep method:

ps -ef | grep -v grep | grep sh | awk '{print $1}'

which fails miserably by finding unhashdaemon, sshd, ksh, bash, csh, etc, none of which were intended.

Replace all of your kill-by-name scripts with the UNIX95 feature of ps.


Bill Hassell, sysadmin
nightwich
Valued Contributor

Re: syslog.log suddenly not updating

Hi

I have the same problem. So I will summarize waht you need to do to solve the problem.

Note: I am suppose that you don't have any "strang" configuration on your syslog.conf

Check the permissions on the files:

ll /var/run/syslog.pid must be -rw-r--r-- 1 root root

ll /var/adm/syslog/syslog.log must be -rw-r--r-- 1 root root

Check the size of ll /dev/log must be zero if not # > /dev/log

Then restart of the syslog:
# kill -HUP $(cat /var/run/syslog.pid)

Check if the syslog restart
#ps -ef | grep syslog

If this do not solve your problem. You can put the defaults of the O.S.

Do the following:

# mv /etc/syslog.conf /etc/oldsyslog.conf

# cp /usr/newconfig/etc/syslog.conf /etc/syslog.conf

# kill -HUP $(cat /var/run/syslog.pid)

Regards,
Angelo Sousa.