syslog.log and mail.log not tracking

[Ling_2]

Hi

I have cleared some logs in var a couple of days ago and since then my syslog.log and mail.log in /var/adm/syslog is no longer tracking of the logs. Both logs have been empty since... Is there any ways to check what is wrong with it? Please advice, Thanks!

[Steve Steel]

Hi


Check your permissions


try

/sbin/rc2.d/S220syslogd stop
/sbin/rc2.d/S220syslogd start

To restart syslog daemon

Steve Steel

[Michael Tully]

This will happen if the logs files are just removed. You must actually close down the daemons or adjust the files by using vi and removing the lines.

To fix your problem:

# touch /var/adm/syslog/syslog.log ; chown root:root /var/adm/syslog/syslog.log ; chmod 644 /var/adm/syslog/syslog.log
# touch /var/adm/syslog/mail.log ; chown root:root /var/adm/syslog/mail.log ; chmod 644 /var/adm/syslog/mail.log

to start mail
# /sbin/init.d/sendmail stop
# /sbin/init.d/sendmail start

to start syslog
# /sbin/init.d/syslogd stop
# /sbin/init.d/syslogd start

There are automatic scripts that can be iinstalled, have a look at these two postings, where there is an abundance of scripts.

http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0x836cc1c4ceddd61190050090279cd0f9,00.html
and
http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0x026250011d20d6118ff40090279cd0f9,00.html

[malay boy]

Hi,
well,please check the file permission.Below are the syslog file permission for my server syslog:

-rw-r--r-- 1 root root 116463 Apr 28 16:39 syslog.log


regards
mB

[Ling_2]

Hi

Thanks for the informations! There is no problem with the permission of the syslog. I restarted the syslog and both logs are working fine now. Thanks!! :)

[Ling_2]

By the way, I have having such errors in my syslog.log, it is serious?

Apr 28 16:24:00 app1 vmunix: SCSI: Read error -- dev: b 31 0x001000, errno: 126, resid: 2048,
Apr 28 16:24:00 app1 vmunix: blkno: 8, sectno: 16, offset: 8192, bcount: 2048.

[Paul Senior]

The syslog entry seems to be complaining the O/S cannot perform some read requests from disk device c1t0d0 - it looks like you have some data corruption.

What is installed on this disk device?
When did the error start and what system changes (DB/OS/ application) had been made prior to it?
Running fsck on the device c1t0d0 (while in single user mode) would be a good way of determining the extent of the corruption.
If you do this check lost+found for orphan files moved by fsck (you may have to restore these from a backup.

An obvious point - if you have hardware support on your disks, don't be afraid to use it.The link below may be useful

http://www4.itrc.hp.com/service/cki/docDisplay.do?docLocale=en_US&docId=200000062951860

Paul Senior

[Paul Senior]

and the following link:-

http://www4.itrc.hp.com/service/cki/docDisplay.do?docLocale=en_US&docId=200000065051375


Paul Senior

[John Waller]

As mentioned the syslog.log and mail.log are always open and locked by the sendmail and syslogd process. An rm command removed the inode entry but does not free the spave in /var. To clear either of the following work.
cp /dev/null syslog.log
>| syslog.log.

If they are removed by accident a a /sbin/init.d/sendmail stop ; /sbin/init.d/sendmail start, and the same for syslogd will restart the logging.

[Michael Steele_2]

Regarding:

Apr 28 16:24:00 app1 vmunix: SCSI: Read error -- dev: b 31 0x001000, errno: 126, resid: 2048,
Apr 28 16:24:00 app1 vmunix: blkno: 8, sectno: 16, offset: 8192, bcount: 2048.

I believe this is disk 'c0t1d0'. Please verify with a lvlnboot -v display.

To correct the problem, normally 'fsck' is called for, but in this case the O/S is involved so I'd suggest a reboot. 'fsck' is called during reboot.

Also, since its your O/S, make some backup tapes just in case, make_tape_recovery, etc.

Is your alternate OK?

[Ling_2]

Hi

I did a lvlnboot -v display but i had the following error.

lvlnboot: Volume group "/dev/display" does not exist in the "/etc/lvmtab" file.

Any help please? Thanks!

[Yogeeraj_1]

hi,

below a quote from man lvlnboot:


SYNOPSIS
/usr/sbin/lvlnboot [[-A autobackup] { -b boot_lv | -d dump_lv | -r root_lv | -R | -s swap_lv }] [-v] [vg_name]
/usr/sbin/lvlnboot [-c]


You should rather issue the following instruction:

E.g.
lvlnboot -v /dev/vglvmroot

or
==============================================================
# lvlnboot -v
Boot Definitions for Volume Group /dev/vg00:
Physical Volumes belonging in Root Volume Group:
/dev/dsk/c1t2d0 (0/0/1/1.2.0) -- Boot Disk
/dev/dsk/c2t2d0 (0/0/2/0.2.0) -- Boot Disk
Boot: lvol1 on: /dev/dsk/c1t2d0
/dev/dsk/c2t2d0
Root: lvol3 on: /dev/dsk/c1t2d0
/dev/dsk/c2t2d0
Swap: lvol2 on: /dev/dsk/c1t2d0
/dev/dsk/c2t2d0
Dump: lvol2 on: /dev/dsk/c1t2d0, 0

#
==============================================================
hth
Yogeeraj

[Ling_2]

Thanks! But i didnt see c1t0d0 from the list, does it mean that it is not in use?

[Michael Steele_2]

This device "...dev: b 31 0x001000..." is c0t1d0 not c1t0d0.

Did you successfully reboot to clean up your O/S file systems with the 'fsck' command? That's what you need.

Make sure you've got a good 'make_tape_recovery' tape.

Make sure you've done some backups of your data.

Also, please copy and paste your commands display reports so we can look at them first hand.

Thanks!

Good luck!