syslogd behaviour

[MR VILLOT MR MONTAGNE]

Hi,

I would like to have some information about syslogd daemon.
For several days I did not have log in syslog file (last message was file system full) but daemon was running.
I restarted the daemon and now it is OK.
The file system which was full was /var.

What is the behaviour of syslogd daemon when /var is full ? Does it stop to write in syslog.log file ?

thanks
Laurent

[RAC_1]

YEs. That is what my rational thinking says.

If it does not have space to write, where it will right. Seems right behaviour to me.

I prefer seperate file systems for /var/adm, /var/adm/sw, /var/opt/perf

Anil

[Robert-Jan Goossens]

Hi Laurent,

Yes, what you describe in your thread is exact what will happen to a system when /var filesystem is full. Syslogdaemon will be unable to write to the syslog file and will hang. Restarting the syslogd will enable it again.

Regards,
Robert-Jan

[Bill Hassell]

/var is THE most critical filesystem in HP-UX. It cannot fill up or many, many things will break! syslog stops logging (and will not restart automatically), logins and failed logins will not be logged (wtmp and btmp), printing stops, email stops, and so on. And many applications will crash (although a professionally written program will gracefully shutdown with useful console messages--not many of those exist). Do not allow /var to fill up. It must be regularly cleaned up (ie, cron). Don't just remove files, especially logfiles. Summarize log files, then compress them if you need long term details, then zero the logs. Monitor /var/adm/crash--it will be empty except after a crash. The crash should be analyzed or stored onto tape and removed. Run the cleanup command to take care of superceeded patches.

[MR VILLOT MR MONTAGNE]

Thanks for Information.
It was Oracle which put "some big files" in /var/tmp.

Laurent