syslog stops writing to log after approx 30 days

[joe clark]

On an 11.0 box the syslog daemon stops writing to its log after approxiametely 30 days, once I restart it everything works again. Any ideas.

[John Poff]

Hi,

Is your syslogd daemon running? Maybe you have a script that runs once a month to clean up logs files that is cleaning up the syslog and not restarting syslogd?

JP

[Pete Randall]

Check for cron jobs that mess with syslog.

Pete

[Cheryl Griffin]

Joe,
Is syslogd still running at the time its stops writing? Check /dev/log and klog:
# ll /dev/log /dev/klog

/dev/log is named pipe and should be 0:
prw-rw-rw- 1 root root 0 Mar 3 9:10 /dev/log

The major number from your list for klog, 189 in this example should match the kernel driver:
crw------- 1 bin bin 189 0x000000 Nov 21 10:27 /dev/klog

# lsdev 189
Character Block Driver Class
189 -1 klog pseudo

If not you may need to recreate the device.
More details will help diagnose the problem.
Cheryl

[John Bolene]

Also check for your /var file system getting full. All it takes is one time trying to write to a full file system to disable syslog writing.

[Ross Zubritski]

Are there any entires in the syslog with regards to "syslogd exiting on signal blah blah?

Regards,

RZ

[Carlos Fernandez Riera]

To make syslogd, re-read its configuration file, send it a HANGUP signal:
kill -HUP `cat /var/run/syslog.pid`


man syslogd


Each time you run a rm for any file created by syslogd you should send a signal to syslogd.

deleting and recreating the file is not valid.

[joe clark]

the syslog daemon is running at the time it stops writing to the log. To Cheryl's response, I checked the /dev/log and dev/klog -everything matches up like the examples you have there. To John's response, we may have something there, I see that /var fills up sometime during the night for a very short amount of time, and syslog seems to be ok, but it may be a timing issue like you mentioned. I will chase down what is filling up /var for the couple of minutes during the night. I guess I was thinking that since syslog continued to write after var filled up temporary, I didn't see the coorelation. Thanks everyone.
Joe

[Sridhar Bhaskarla]

Hi Joe,

You would need to check these pipe files /dev/log and /dev/klog while your syslog stopped writing.

If your system logs too much, then keeping one big file is not a good idea. You may want to trim your syslog and recycle it periodically. Here is a sample script may give you an idea how to do it.

//

#!/usr/bin/ksh
FILE=/var/adm/syslog/syslog.log
/sbin/init.d/syslogd stop
i=7
while [ $i -gt 0 ]
do
(( j = $i - 1 ))
if [ -f ${FILE}.${j} ]
then
mv ${FILE}.${j} ${FILE}.${i}
fi
(( i = $i - 1 ))
done
mv $FILE $FILE.1
/sbin/init.d/syslogd start

//

Put it in cron and run it probably once in a week or so. Change the value of i to reflect how many copies of syslog you want to keep.

-Sri

[W.C. Epperson]

Last time I saw this, a well meaning sysadmin had put in a cron script to rotate log files.
--Copied log file to archive.
--Removed log file.
--Touched log file to recreate.

Of course, when you remove a log file from underneath a running daemon, the daemon keeps the file handle open and happily writes to the old handle. What you see is the new file created by the script, empty. When you restart the daemon, it releases the handle and starts writing to the new file.