Operating System - HP-UX
1752328 Members
5920 Online
108786 Solutions
New Discussion юеВ

/var/adm/syslog/mail.log and syslog.log not updating

 
SOLVED
Go to solution
The Gunners
Regular Advisor

/var/adm/syslog/mail.log and syslog.log not updating

Hi ,
I was just doing a general scoot around the system and noticed the following files have not been updated in a few months - Anyone any ideas ? - I have no space issues at all

-r--r--r-- 1 root root 28050618 Aug 13 16:03 mail.log
-rw-r--r-- 1 root root 98776950 Aug 13 16:29 syslog.log
16 REPLIES 16
James R. Ferguson
Acclaimed Contributor

Re: /var/adm/syslog/mail.log and syslog.log not updating

Hi Davey:

This sounds as if someone tried to trim (null) the files by moving the current file to "*.old" and then touching (or redirecting '/dev/null' into a new file). This leaves the open file descriptor pointing at the ".old" file.

The correct way to preserve data and trim to zero bytes is to 'cp' the current file as "*.old" and then redirect (truncate) the current file.

Regards!

...JRF...

Pete Randall
Outstanding Contributor

Re: /var/adm/syslog/mail.log and syslog.log not updating

So the answer is to restart the respective daemons so they do end up pointing to the correct files.


Pete

Pete
Kapil Jha
Honored Contributor

Re: /var/adm/syslog/mail.log and syslog.log not updating

Restart the mail daemon and syslogd and use logger to check if it is working fine

#logger "checking if its working"

BR,
Kapil+
I am in this small bowl, I wane see the real world......
Suraj K Sankari
Honored Contributor

Re: /var/adm/syslog/mail.log and syslog.log not updating

Hi,
>>I have no space issues at all

If you have not a space issue problem then you can leave those files as they are.

If you want to trim those files then you can take a backup copy of them and trim the file.

>mail.log
>syslog.log

Suraj
The Gunners
Regular Advisor

Re: /var/adm/syslog/mail.log and syslog.log not updating

Thanks everyone for info so far , it does seem to be functioning fine , I got an email to my outlook from this system this morning with backup log details , so mail does seem to be working , even though it says the last entry was on August 13 , Im still a bit confused to be honest , which file is it actually writing to now Im wondering ?
Dennis Handly
Acclaimed Contributor

Re: /var/adm/syslog/mail.log and syslog.log not updating

>which file is it actually writing to now Im wondering?

You could use lsof to see where it is writing.
unix adm
Regular Advisor
Solution

Re: /var/adm/syslog/mail.log and syslog.log not updating

Hi Davey,
You can see /etc/syslog.conf there is you can find what logs are going where.

Restart syslog daemon and sendmail daemon

/sbin/init.d/syslog.d stop
/sbin/init.d/syslog.d start

/sbin/init.d/sendmail stop
/sbin/init.d/sendmail start

this should rename the current file to old one and restart writing the fresh syslgo.log file, then using logger message command check if it is logging OK in the syslog.log file with correct date.

If still does not help try ftping syslogn.conf file from another working system and restart the daemons, this should help.

also , I know its stupid but check the date of your system as you said your mails are still working.


Thanks

Raj
Bill Hassell
Honored Contributor

Re: /var/adm/syslog/mail.log and syslog.log not updating

> it does seem to be functioning fine , I got an email to my outlook from this system this morning with backup log details , so mail does seem to be working , even though it says the last entry was on August 13 , Im still a bit confused to be honest , which file is it actually writing to now Im wondering ?

Always test syslogd with logger as mentioned above. These two commands will put an entry at the end of the two logs (assuming you have a standard syslog.conf file):

logger "testing syslog.log"
logger -p mail.info "testing mail.log"

If nothing shows up, then syslogd is not running or not writing to the current syslog.log and mail.log files. Stop and restart syslogd and repeat the logger test. If logger still does not write anything new, then list the syslog.conf file using cat -t:

cat -t /etc/syslog.conf
mail.debug^I^I/var/adm/syslog/mail.log
*.info;mail.none;local5.none;auth.none^I/var/adm/syslog/syslog.log
auth.info^I^I/var/adm/syslog/auth.log
local5.info^I^I/var/adm/syslog/ftpd.log
*.alert^I^I^I/dev/console
*.alert^I^I^Iroot
*.emerg^I^I^I*

There must be *NO* spaces anywhere in the file. The ^I symbol is the TAB character but in vi, it looks like spaces. This space character restriction has always existed for syslogd.


Bill Hassell, sysadmin
The Gunners
Regular Advisor

Re: /var/adm/syslog/mail.log and syslog.log not updating

Hi Everyone , ok , STopped / restarted both and this is what I get left with - looks like its created a new syslog.log , but the mail file looks the same one , v strange

kilhp01:/ # /sbin/init.d/syslogd start
System message logger started
kilhp01:/ #
kilhp01:/ # /sbin/init.d/sendmail stop
Sendmail pid is 1253
Killing sendmail
Please wait .....
Sendmail killed.
kilhp01:/ # /sbin/init.d/sendmail start
/etc/mail/aliases: 7 aliases, longest 9 bytes, 88 bytes total
sendmail
kilhp01:/ # pwd
/
kilhp01:/ # cd /var/adm/syslog
kilhp01:/var/adm/syslog #
kilhp01:/var/adm/syslog #
kilhp01:/var/adm/syslog # ls -al
total 247776
dr-xr-xr-x 2 bin bin 96 Oct 13 14:21 .
drwxr-xr-x 15 adm adm 8192 Apr 2 2008 ..
-rw-r--r-- 1 root root 98776950 Aug 13 16:29 OLDsyslog.log
-r--r--r-- 1 root root 28050618 Aug 13 16:03 mail.log
-rw-r--r-- 1 root sys 0 Oct 13 14:21 syslog.log