syslog.log suddenly not updating

[n00body]

Hi friends , i'm having problem with syslog.log . I found that it was not updating .. i restarted it and test a logger message .. it was working .. and on the next day .. I found out that the syslog.log was again stopped at the same time as the previous day .

Normally what is the possible causal that can stop syslogd from running . Thank you guys ..

[Ivan Krastev]

What is the size of the syslog.log file - there is a patch for files over 2GB. Check also for an additional syslog patches.

regards,
ivan

[Duncan Edmonstone]

What Ivan describes is 1 possibility. The other is that the filesystem that syslog.log sits in has filled (this is usually /var).

HTH

Duncan

[n00body]

Thank you guys for the reply .. he is what i found :

Filesystem kbytes used avail %used Mounted on
/dev/vg00/lvol10 512000 104814 382595 22% /var

~~~~~~~~~~~~~~~~

and this is the late entry in the syslog . I even tested with Logger .. but it wont be appended untill i restart the syslogd daemon . The weird thing is the syslog is stopped at the same time everyday .

Jan 17 06:57:56 sg1sys02 sshd[27414]: Received disconnect from 145.240.153.36: 11: Terminating connection
Jan 17 07:00:00 sg1sys02 syslog: su : + tty?? root-oracle

[Jeeshan]

what is the configuration of /etc/rc.config.d/syslogd file?

[Torsten.]

Any related messages in syslog?

(the message above is from disconnecting ssh and a "su" session).

[n00body]

hi ahsan .. i believed you 're referring to /etc/syslogd.conf . Here is the current config
~~~~~~~~~~~~~~~~~~~~~~~~~~~

root@sg1sys02/etc # more syslog.conf
# @(#) $Revision: 74.1 $
#
# syslogd configuration file.
#
# See syslogd(1M) for information about the format of this file.
#
mail.debug /var/adm/syslog/mail.log
*.info;mail.none /var/adm/syslog/syslog.log
*.alert /dev/console
*.alert root
*.emerg *
root@sg1sys02/etc # pwd
/etc

[Jeeshan]

No.

i'm asking about /etc/rc.config.d/syslogd file configuration which is responsible for running the daemon.

[n00body]

I couldn't find any syslogd.conf in that dir

~~~~~~~~~~~~~~~~~~~~~~
root@XXXX/ # ls /etc/rc.config.d/syslogd
/etc/rc.config.d/syslogd not found
root@XXXX/ # cd /etc/rc.config.d
root@XXXX/etc/rc.config.d # ls | grep log
root@XXXX/etc/rc.config.d # ls | grep syslog
root@XXXX/etc/rc.config.d # uname -an
HP-UX XXXX B.10.20 A 9000/889 263814391 two-user license
root@XXXX/etc/rc.config.d # model
9000/889/K460
root@XXXX/etc/rc.config.d #

[Jeeshan]

i didn't say syslogd.conf


I said only syslogd file

[Bill Hassell]

The first question is: is syslogd running when the log stops? If not, some root cronjob has killed the syslogd daemon. This is very common with badly written cron jobs that kill the wrong process ID. Look for kill commands in all cron jobs and remove any that use ps piped to grep. This is a very unstable method and root scripts can do very bad things to your system when wrong process IDs are selected.

The only sane way to find processes by name is to use the -C option, which requires the UNIX95 variable. To find just the process IDs for sh, use this:

UNIX95=1 ps -C sh -o pid=

Compare the output of the above command with the typical grep method:

ps -ef | grep -v grep | grep sh | awk '{print $1}'

which fails miserably by finding unhashdaemon, sshd, ksh, bash, csh, etc, none of which were intended.

Replace all of your kill-by-name scripts with the UNIX95 feature of ps.

[nightwich]

Hi

I have the same problem. So I will summarize waht you need to do to solve the problem.

Note: I am suppose that you don't have any "strang" configuration on your syslog.conf

Check the permissions on the files:

ll /var/run/syslog.pid must be -rw-r--r-- 1 root root

ll /var/adm/syslog/syslog.log must be -rw-r--r-- 1 root root

Check the size of ll /dev/log must be zero if not # > /dev/log

Then restart of the syslog:
# kill -HUP $(cat /var/run/syslog.pid)

Check if the syslog restart
#ps -ef | grep syslog

If this do not solve your problem. You can put the defaults of the O.S.

Do the following:

# mv /etc/syslog.conf /etc/oldsyslog.conf

# cp /usr/newconfig/etc/syslog.conf /etc/syslog.conf

# kill -HUP $(cat /var/run/syslog.pid)

Regards,
Angelo Sousa.