Syslog.log and full file system.

[Dan DeHaan]

What happens to the syslog.log entries when the /var file system fills up? Last week my /var system filled. I quickly recovered some space. I looked at the syslog.log today and noticed that there have been no entries since the system filled up. I had to restart the syslog daemon to start the log again. Where have the enties gone? Are they lost in memory? Are they recoverable?

[Pat Lieberg]

Unfortunately, I believe those entries are gone. It sounds like the syslog daemon was hung when var filled up, which means it would not be logging any new entries.

[baiju_3]

I think the lost messages are not recoverable .If syslog.log is not getting updated you may have to restart the syslog daemon by ,


/sbin/init.d/syslog.d stop and start


thx,
bl.

[Mel Burslan]

Unfortunately, the entries can not be recovered as they have not been written anywhere. This is why it is a good practice to check your vital system related filesystems for capacity at least daily or more frequently.

[Robert-Jan Goossens]

If /var filesystem fills up (100 % full) the syslog daemon can not write to the syslog anymore, and so the messages are lost and can not be recovered.

Regards,
Robert-Jan

[Dan DeHaan]

Thanks folks. That is what I thought and was afraid of.

[Stephen Keane]

You can always edit /etc/syslog.conf and get messages copied to an alternate location on another filesystem, in case this happens again in the future.