syslog.log not updating

[Jeff Picton]

Hello

One of our HPUX11 servers has not updated the syslog.log since 13th Oct 2003. Can anyone point me as to which script outputs to this log and to why it is not updating ?

Thks

Jeff

[john korterman]

Hi,
check if the syslog daemon is running, e.g.:
# ps -ef | grep syslog
root 842 1 0 Sep 19 ? 0:07 /usr/sbin/syslogd -D

regards,
John K.

[Jeff Picton]

Hi

Have done this and the syslog daemon is running :-

ps -ef | grep syslog
root 518 1 0 Oct 1 ? 0:43 /usr/sbin/syslogd -D
root 17212 7690 1 09:26:44 pts/3 0:00 grep syslog

[john korterman]

Hi,
the try to execute this:
# logger new entry in log

and check if it is written to the syslog.

regards,
John K.

[Stefan Farrelly · Accepted solution]

Just restart syslogd; /sbin/init.d/syslogd stop/start

It happens ocassionally. Ensure you have the latest syslog patch, for 11i;

PHCO_23413 1.0 patch for syslogd(1M)

[Jeff Picton]

Hi

I have stopped / started syslog daemon and the logger command logged OK to syslog.

[john korterman]

Hi again,
then try to make an ftp connection and check if that is written to the log.

regards,
John K.

[Jeff Picton]

Hi John

Yes that was also logged in syslog OK

Jeff

[john korterman]

Hi again,
well, in that case I would think that it should now be working ok, but I suggest that you keep an eye on it.
I do not know if this is a patch problem, but Olympians are rarely wrong!

regards,
John K.

[Jeff Picton]

Funnily enough the file /var/adm/syslog/mail.log also stopped logging on the 13th.

Coincidence ?

[john korterman]

Hmmm,
I have seen forum threads reporting on failing writes to both logs. However, without finding any perfectly satifying explanation. A far out theory could be that someone has cleaned up by removing the "live" logfiles and afterwards created new files. He may then have seen that nothing was written to the files and has therefore regretted by copying back the old files into the original place. In that case there will not be written to the files until the daemon has been restarted.
But I admit it is far out...

regards,
John K.

[Jeff Picton]

Hi

What is the daemon called which re-starts the logging to the mail.log ?

Jeff

[Pete Randall]

Jeff,

Stop and restart the sendmail daemon:

/sbin/init.d/sendmail stop
/sbin/init.d/sendmail start


Pete

[Elmar P. Kolkman]

Nope... It is
/sbin/init.d/syslogd stop
/sbin/init.d/syslogd start

sendmail sends its logging to the syslog daemon which in turn sends it to the corresponding log files.

[Elmar P. Kolkman]

But I saw you already did that. In that case it seems your /etc/syslog.conf doesn't contain the lines for the mail.log file anymore.

[Jeff Schussele]

Hi Jeff,

I've seen the syslogd daemon hang because /var filled up & was then cleaned up.
Problem with determining this is that the log entry stating that /var filled up doesn't get written to syslog.log....BECAUSE...it filled up.
This is one of those cases where an external syslog server is good to have.

My 2 cents,
Jeff

[Jeff Picton]

Hi

Thanks for all the replies.

Both log files are now initialised and updating once again.

Jeff