mail.log file is not updating

[Waqar Razi]

mail.log file under /var/adm/syslog directory is not getting updated?

Can some one give me some clue?

[Tim Nelson]

post the output of /etc/syslog.conf please.

If you zero'd it out, you may need to sig_hup the syslogd process.

[Waqar Razi]

# @(#) $Revision: 74.1 $
#
# syslogd configuration file.
#
# See syslogd(1M) for information about the format of this file.
#
mail.debug /var/adm/syslog/mail.log
*.info;mail.none /var/adm/syslog/syslog.log
*.alert /dev/console
*.alert root
*.emerg *

[James R. Ferguson]

Hi:

When did it stop updating? What did you do beforehand? DId you rename ('mv') the current file?

Regards!

...JRF...

[Tim Nelson]

Try this.

ps -ef|grep syslogd
kill -1 PID_OF_SYSLOGD

[Bill Hassell]

syslogd has a VERY restricted format for syslog.conf: NO SPACEE! If you recently edited this file, that is probably why mail.log has not been getting any records. Look at every line with this command:

cat -t /etc/syslog.conf

It should look like this:

#
mail.debug^I^I/var/adm/syslog/mail.log
*.info;mail.none;local5.none;auth.none^I/var/adm/syslog/syslog.log
auth.info^I^I/var/adm/syslog/auth.log
local5.info^I^I/var/adm/syslog/ftp.log
*.alert^I^I^I/dev/console
*.alert^I^I^Iroot
*.emerg^I^I^I*

Notice all the ^I characters which represent tabs. No spaces are allowed except in comments. If a space exists in a directive line, the line is ignored.

[Johnson Punniyalingam]

Make sure that /etc/syslog.conf is not configured to log information
into a different file.

Be sure and check the space in /var. This kind of problem has been
seen
when /var is full and the syslog daemon could no longer write to the

Verify that syslogd is running:
# ps -ef |grep syslogd
root 435 1 0 Jun 2 ? 0:00 /usr/sbin/syslogd -D

/etc/syslog.conf could be corrupt. For example, a 'space' character
instead of a 'tab' between columns may cause syslogd to stop logging.
See 'man syslogd':
"The action field is separated from the selector by one or more tabs."

Save your /etc/syslog.conf to a different name:
# mv /etc/syslog.conf /etc/oldsyslog.conf

Copy the file /usr/newconfig/etc/syslog.conf to /etc/syslog.conf:
# cp /usr/newconfig/etc/syslog.conf /etc/syslog.conf

kill -HUP $(cat /var/run/syslog.pid)

Note: Look for the restart message in /var/adm/syslog/syslog.log:
Mar 2 13:23:58 system1 syslogd: going down on signal 15
Mar 2 13:24:11 system1 syslogd: restart

If syslogd still does not log information to syslog.log:

Check if the named pipe used by syslogd is full:
# ll /dev/log
prw-rw-rw- 1 root root 0 Mar 2 14:42 /dev/log

If the size is greater than 0, clear it out:
# > /dev/log

Verify that /dev/klog exists:
# ll /dev/klog
crw------- 1 bin bin 189 0x000000 Jun 26 2001
/dev/klog


Restart syslogd
================
# mv /etc/syslog.conf /etc/syslog.conf.OLD

# cp /usr/newconfig/etc/syslog.conf /etc/syslog.conf

Another thing to try is to start syslogd with the -d option, which
enables debug logging. If syslogd still doesn't start when the default
/etc/syslog.conf file is in place, hopefully the debug output of launching
syslogd with -d will give you an indication as to why.

# /usr/sbin/syslogd -d -D

The -d option will cause syslogd to run in the foreground, but again,
hopefully it will tell you why it is exiting - assuming it does exit
with an error.

Rgds,
Johnson