syslog.log staying empty

[Randy Brown_1]

I noticed this morning that /var/adm/syslog/syslog.log is 0 bytes. The machine was rebooted this morning and I did not notice anything during the reboot that would point me to anything being wrong. I have looked through rc.log and don't see anything there either. A ps -ef |grep syslog shows that syslogd is running. Things have been fine until the reboot this morning. Even using logger doesn't put entried in the syslog.log file. Any thoughts? I will gladly provide more info as needed.

Thank you,

Randy

[Patrick Wallek]

Check your /etc/syslog.conf file and see if perhaps someone made a change and are now writing things to a file other than /var/adm/syslog/syslog.log.

[Steven E. Protter]

What are the permissions on the file /var/adm/syslog/syslog.log

check /etc/rc.config.d/syslogd for anything unusual.

Don't make a backup copy in /etc/rc.config.d it will mess things up.

SEP

[Pete Randall]

Randy,

I think Patrick's probably on the right track, but what about permissions? And, does OLDsyslog.log contain anything?


Pete

[Chris Wilshaw]

You could try to use

kill -HUP

on the syslogd process - this should force it to re-read the config file.

Also, you should confirm that you have free space in /var

[Massimo Bianchi]

Hi,
my working /etc/syslog.conf:

# @(#) $Revision: 74.1 $
#
# syslogd configuration file.
#
# See syslogd(1M) for information about the format of this file.
#
mail.debug /var/adm/syslog/mail.log
*.info;mail.none /var/adm/syslog/syslog.log
*.alert /dev/console
*.alert root
*.emerg *


To have the system re-read it,
just issue

To make syslogd, re-read its configuration file, send it a HANGUP
signal:

kill -HUP `cat /var/run/syslog.pid`


Massimo

[Hai Nguyen_1]

Randy,

Check the content of /etc/syslog.conf to see if it has been modified.

Hai

[Jeff Schussele]

Hi Randy,

Sounds like syslogd is hung. You need to determine the PID
ps -ef | grep syslog
Then kill -HUP it
kill -HUP XXXX #where XXXX=syslogd_PID

If a new ps -ef | grep syslog does not show a new PID, then kill XXXX & run
/usr/sbin/syslogd -D
to restart it.

HTH,
Jeff

[David_246]

Hi Randy,

Sometimes it's a problem with you file in use as well (corrupt).
- Stop syslog
- mv your current syslog.log file
- touch a new one.
- and start sylogd

It should work fine now. kill -HUP should give you some extra data in you syslog.log, also of course the program logger should add some lines in there.
Make sure your syslog.conf has all permissions and does not conatain any weird characters.

Regs David

[Jeff Schussele]

There's a way to test whether syslogd is hung.
Enter the following command

logger "This is a test log entry"

Then check the syslog.log file. If it doesn't appear then syslogd is definitely hung & you'll have to bounce it.

Also I'd check /etc/rc.log to see if S220syslogd had trouble starting in run-level 2.

HTH,
Jeff

[Randy Brown_1]

Thank for all of the responses.

Here is some more info:

-rw-r--r-- 1 root sys 0 Jul 23 07:54 syslog.log

-rw-r--r-- 1 root sys 0 Jul 23 07:46 OLDsyslog.log

# @(#) $Revision: 74.1 $
#
# syslogd configuration file.
#
# See syslogd(1M) for information about the format of this file.
#
mail.debug /var/adm/syslog/mail.log
*.info;mail.none /var/adm/syslog/syslog.log
*.alert /dev/console
*.alert root
*.emerg *

#Log to a log host too. BSM - 10/2/00
*.info @watcher

The file system has space on it (plenty). I did just find tabs in the last entry of the syslog.conf file. I removed them and stopped and started syslogd but still have 0 bytes in syslog.log

[Hai Nguyen_1]

Randy,

Can you post the output of this command:

# ll /dev/klog /dev/log /dev/log.un

Hai

[Randy Brown_1]

No problems in rc.log either

Start system message logging daemon
Output from "/sbin/rc2.d/S220syslogd start":
----------------------------
System message logger started

This is stumping me completely. I moved the syslog.log file and touched a new one too and still nothing. Hmmmmm.

[Randy Brown_1]

[clifford_root]$ll /dev/klog /dev/log /dev/log.un
/dev/log.un not found
crw------- 1 bin bin 189 0x000000 Aug 2 1999 /dev/klog
prw-rw-rw- 1 root root 0 Jul 23 11:08 /dev/log

[Hai Nguyen_1]

Randy,

jabs-hpl # ll /dev/klog /dev/log /dev/log.un
crw------- 1 bin bin 189 0x000000 Dec 10 1999 /dev/klog
prw-rw-rw- 1 root root 0 Jul 23 11:11 /dev/log
srw-rw-rw- 1 root root 0 Jul 17 14:20 /dev/log.un

Your output should look similar to the above. The missing /dev/log.un is needed (it is a socket file). Let me research on how to recreate it. Then I'll get back to you.

Hai

[Hai Nguyen_1]

Randy,

Can you try this:

# echo "this is a test" > /dev/log
# cat /var/adm/syslog/syslog.log

You should see the line "this is a test" in the syslog.log.

Hai

[John Payne_2]

Is /var full? (Or /var/adm/syslog/syslog.log's filesystem, if you changed it.)

Your configuration looks ok.

Hope it helps

John

[Randy Brown_1]

There's plenty of room on the file system. Is there somewhere other than rc.log I can look for errors recorded during boot up?

Randy

[Wouter Jagers]

issue 'dmesg'

regards
Wout

[D. Jackson_1]

Just a stab, but is "watcher" on the network, can it be seen by this system?

Just a thought.
GL

[Tim Adamson_1]

Hi Randy,

That watcher entry in the syslog.conf file is not standard. Why not comment it out, restart syslogd and see if it makes a difference.


Cheers!

[Randy Brown_1]

The problem ended up being the syslog.conf file. I recreated it from scratch, stopped and started syslogd and it started working. Thank you for all of the comments and suggestions. It's nice to know that so many people are willing to help.

Regards,

Randy