Operating System - HP-UX
1834048 Members
2530 Online
110063 Solutions
New Discussion

In 10.20 server syslog is not being written

 
vaman
Frequent Advisor

In 10.20 server syslog is not being written

no syslog written in 10.20 server. syslogd is running.
root 606 1 0 09:45:36 ? 0:00 /usr/sbin/syslogd -D
vaman kulkarni
6 REPLIES 6
Stephen Keane
Honored Contributor

Re: In 10.20 server syslog is not being written

What does /etc/syslog.conf look like?
Bharat Katkar
Honored Contributor

Re: In 10.20 server syslog is not being written

Hi Vaman,
Check this threads below:

http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=186882

http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=741077

Hope that helps.
Regards,
You need to know a lot to actually know how little you know
Vitek Pepas
Valued Contributor

Re: In 10.20 server syslog is not being written

Does log file exist?
Florian Heigl (new acc)
Honored Contributor

Re: In 10.20 server syslog is not being written

I know that one, but neither I know my workmates remember the real cause.

# check if syslogd is really really listening anymore
netstat -na |grep "*.514"
# should return
#tcp 0 0 *.514 *.* LISTEN
#udp 0 0 *.514 *.*
/sbin/init.d/syslogd stop
cd /var/adm/syslog/syslog.log
mv syslog.log syslog.broken
touch syslog.log
/sbin/init.d/syslogd start
sleep 4
logger test

# check if it's listening again, like in the above

if You don't see 'test' in Your syslog after this think about a fsck of /var

I hope this resolves the issue...
yesterday I stood at the edge. Today I'm one step ahead.
Robert Salter
Respected Contributor

Re: In 10.20 server syslog is not being written

Someone didn't do a 'mv' of syslog.log, then '> syslog.log' to re-create it did they? Because if they did, syslogd is logging into thin air, and it will take up your disk space. Like Florian said, you'll have to stop/start syslogd. The safest way to manually maintain syslog.log is to 'cp' it first then '> syslog.log' to zero it out.

L8tr,

Bob
Time to smoke and joke
Matti_Kurkela
Honored Contributor

Re: In 10.20 server syslog is not being written

Stopping and starting syslogd might be a bit overkill. If you send a SIGHUP to syslogd, it should re-read its configuration file and re-open the logfiles. That could also be used to ensure that the switch from old to new logfile(s) happens atomically, so absolutely no messages will be lost.

I think the best method for rotating syslog files would be something like:

cd /var/adm/syslog
# move the old file(s)
# NOTE: syslog will keep logging to the old
# file: don't move it off the filesystem yet
mv syslog.log syslog.old.log

# re-create the logfile(s)
> syslog.log
chmod syslog.log

# switch logging to the new file
# NOTE: this is as close to an atomic
# operation as possible with syslogd
kill -HUP `cat /var/run/syslog.pid`


If you have to rotate the logfiles for some other program which does not provide any internal log rotation facility nor any means to signal "re-open logfile NOW", then the copy-and-truncate may be the best general solution available:

cp otherprogram.log otherprogram.log.old && > otherprogram.log

MK