HPE Community read-only access December 15, 2018
This is a maintenance upgrade. You will be able to read articles and posts, but not post or reply.
Hours:
Dec 15, 4:00 am to 10:00 am UTC
Dec 14, 10:00 pm CST to Dec 15, 4:00 am CST
Dec 14, 8:00 pm PST to Dec 15, 2:00 am PST
cancel
Showing results for 
Search instead for 
Did you mean: 

syslogd terminated

 
atul2701
Frequent Advisor

syslogd terminated

Hi

When i am trying to start the syslogd on my HP UX B.11.31 server it start and terminated immediately. I have tried to replace the /etc/syslog.conf file with /usr/newconfig/etc/syslog.conf.

# ps -ef |grep -i syslog
root 9925 11167 1 06:33:40 pts/0 0:00 grep -i syslog
# /sbin/init.d/syslogd stop
syslogd stopped
# /sbin/init.d/syslogd start
System message logger started
# tail /var/adm/syslog/syslog.log
May 11 06:33:58 whqwm03 syslogd: restart
May 11 06:33:58 whqwm03 syslogd: the kernel messages are already disabled: No such device or address
# cat /var/run/syslog.pid
10171
# ps -ef |grep -iE "10171|syslog"
root 10914 11167 0 06:35:01 pts/0 0:00 grep -iE 10171|syslog
#
Atul Gupta
16 REPLIES
Mel Burslan
Honored Contributor

Re: syslogd terminated

Long, long time ago, I remember encountering a situation like this and the cause of mine being ended up whitespaces in the syslog.conf file instead of tabs. Field separators in syslog.conf file SHOULD BE s, NOT whitespaces.

when you said you copied the newconfig file, you just cat'ed the file and do a screen-scraping (click and drag highlight and copy) then paste into your editor session, what you might end up doing is introducing whitespaces.

If I were you, even if you did not do what I said, I'd check for the existence of whitespaces in this file. Just for precaution if nothing else.
________________________________
UNIX because I majored in cryptology...
Michael Steele_2
Honored Contributor

Re: syslogd terminated

I believe you are on the right track with /usr/newconfig/etc/syslog.conf but I must believe that you have a whitespace or control char still in there.

Question: Did you update the default syslog.conf file or just copy it in?

b) try this

grep -v "^[[:blank:]]*$" syslog.conf > work_file
ls -la both files
cksum both files

Any difference? If so then use the work_file
Support Fatherhood - Stop Family Law
atul2701
Frequent Advisor

Re: syslogd terminated

no luck...

# cd /etc
# grep -v "^[[:blank:]]*$" syslog.conf > work_file
# ls -la syslog.conf
-r--r--r-- 1 bin bin 250 May 12 01:30 syslog.conf
# ls -la work_file
-rw-r----- 1 root sys 250 May 12 01:47 work_file
# cksum syslog.conf work_file
3145885767 250 syslog.conf
3145885767 250 work_file

Atul Gupta
atul2701
Frequent Advisor

Re: syslogd terminated

no luck...

# cd /etc
# grep -v "^[[:blank:]]*$" syslog.conf > work_file
# ls -la syslog.conf
-r--r--r-- 1 bin bin 250 May 12 01:30 syslog.conf
# ls -la work_file
-rw-r----- 1 root sys 250 May 12 01:47 work_file
# cksum syslog.conf work_file
3145885767 250 syslog.conf
3145885767 250 work_file...
Atul Gupta
Laurent Menase
Honored Contributor

Re: syslogd terminated

do you have any 3rd party pam or nss lib?
is there a core?

you can also try a tusc on it to see what it is doing.

Re: syslogd terminated

Michael,

>> grep -v "^[[:blank:]]*$" syslog.conf > work_file

I don't think that regexp is working as you expected - I just added some spaces to a copy of my syslog.conf file and ran it through it, and it didn't pick them up...

atgupta,

Maybe a simpler one, does:

grep ' ' /etc/syslog.conf

(that's a space between the quote ' symbols)

return anything that's not on a comment line?

HTH

Duncan

HTH

Duncan
atul2701
Frequent Advisor

Re: syslogd terminated

Laurent@ bad luck tusc or any other utility is not installed..

Duncan@ grep " " /etc/syslog.conf i already tried and there was no space...

# grep ' ' /etc/syslog.conf
# @(#)B.11.31_LR
# syslogd configuration file.
# See syslogd(1M) for information about the format of this file.
#
Atul Gupta
Michael Steele_2
Honored Contributor

Re: syslogd terminated

Well, I have to believe that this is for information only. Try running some LVM commands like:

vgscan -p -v -a
lvlnboot -R

...and post syslog.log afterwards.
Support Fatherhood - Stop Family Law
atul2701
Frequent Advisor

Re: syslogd terminated

As syslogd terminated immediately after i start it hence its not loging anything in syslog.log...
Atul Gupta
Michael Steele_2
Honored Contributor

Re: syslogd terminated

What are the error messages from dmesg?
What are the error messages on the console?
Support Fatherhood - Stop Family Law
Mel Burslan
Honored Contributor

Re: syslogd terminated

Just for the kick, instead of starting syslogd, using the init script, what happens if you start it directly from the command line as in

/usr/sbin/syslogd

without putting it in background (i.e. daemon mode) is it staying up or dying down immediately ?

Open another terminal window to the same system and run:

while true; do
ps -ef | grep syslogd
done

continuously. This will impact the performance more than likely. So, if this is a production system, you might want to do it after hours. Also capture the terminal session as the output will most probably flow too fast for your eyes to catch anything meaningful.

This may give you a bit more insight and won't hurt anything just by trying.

Just a thought
________________________________
UNIX because I majored in cryptology...
Laurent Menase
Honored Contributor

Re: syslogd terminated

try to start /usr/sbin/syslogd -d

atul2701
Frequent Advisor

Re: syslogd terminated

all above things i have already tried and no luck..

when it dies its creating the core file..
# what core
core:
$ PATCH_11.31/PHCO_39177 May 21 2009 06:51:02 $
$ PATCH_11.31/PHCO_40292 Jul 6 2010 09:44:47 $
92453-07 linker dld HP Itanium(R) B.12.55
92453-07 linker uld HP Itanium(R) B.12.55
#
Atul Gupta
atul2701
Frequent Advisor

Re: syslogd terminated

Thanks all for your valuable time and support.. Finaly i got the solution.

Under syslog dir mail.log file size was 2Gb. i have trimmed the same and after that start the syslogd daemon and running fine..

Atul
Atul Gupta
Ismail Azad
Esteemed Contributor

Re: syslogd terminated

Hey atgupta,

Well I guess the moral of this scenario turns out to be trimming certain stuff once in a while on the /var filesystem... Be it the syslog, or let's say the wtmps or btmps file. That's why on a server that you consider important it's momentous to check if the /var is reaching let's say 98% with very less free space left.

Regards
Ismail Azad
Read, read and read... Then read again until you read "between the lines".....
atul2701
Frequent Advisor

Re: syslogd terminated

Its not bcoz /var fs is running out of space. /var utilization was around 58% only.

there is a bug in 11.31 Syslogd is checking or calling mail.log. That’s the reason need to trim down some files with near or greater than 2GB or modifying the LOG_SIZE=NOLIMIT in /etc/defaults/syslogd file.

Atul Gupta