Syslog.log not logging anymore ...

[Chushia]

On Friday one of my colleague ran a program at background that required passwd. He didn't notice this so the program ran with extensive tmp file in /var over the weekend filling up the file system /var. After we killed the program, the space it took on /var were released. All went well ever since except, /var/adm/syslog/syslog.log, mail.log, wtmp, btmp all stopped logging.

How can I make them work again ? I hope not to reboot the server.

Thanks,
Chushia

[A. Clay Stephenson]

/sbin/init.d/syslogd start

[Patrick Wallek]

For syslog:

# /sbin/init.d/syslogd stop
# /sbin/init.d/syslogd start

For mail.log:

# /sbin/init.d/sendmail stop
# /sbin/init.d/sendmail start

wtmp and btmp should start logging again automatically.

[DCE]

Chusia,
the first thing you should do is stop/start the syslogd daemon

There are several ways to stop/start the syslog daemon listed in the man page for syslogd

I prefer to issue the commands

/sbin/init.d/syslogd stop
/sbin/init.d/syslogd start

to stop/start the daemon

[Chushia]

Thanks, A.Clay, Patrick and DCE.
Now syslog and mail log are all functioning.

For wtmp and btmp, I can see the time stamp did show current. But "last" command didn't show any new login information. How to fix this, please ?

Thanks,
Chushia

[A. Clay Stephenson · Accepted solution]

/var/adm/wtmp almost certainly is corrupt. You need to use fwtmp to output the file in ASCII mode to a text file and then remove any bogus entries and then use fwtmp agin to read your edited file and output in binary format. Man fwtmp and wtmpfix for details.

[Mridul Shrivastava]

When pcnfsd receives a PCNFSD_AUTH or PCNFSD2_AUTH
request, it will "log in" the user by validating the
user name and password, returning the corresponding
user ID, group IDs, home directory, and umask. It
will also append a record to the wtmp data base
(see wtmp(4)). If you do not want PC "logins"
recorded in this way, add a line to the /etc/pcnfsd.conf
file in the form:

wtmp off

[Greg Vaidman]

try /usr/sbin/acct/startup to reactivate writing to wtmp file...

[Chushia]

Thanks A. Clay!

The wtmp file is corrupted.
I used fwtmp to translate the file to ASCII to edit and then fwtmp to translate it back to wtmp format. Now the "last" gives account information ...

Greatly appreciated!
Chushia