syslogd is not working

[천순철_2]

hi,, everybody.. my system is HP N4000(11.00)

something wrong in my syslog configuration..what can i do ??

---------------------------
cat /etc/syslog.conf
# the following line is required for Intruder Alert
# *.info;mail.err;mark.none /axent/ita/system/stsvc/syslog
# @(#) $Revision: 74.1 $
#
# syslogd configuration file.
#
# See syslogd(1M) for information about the format of this file.
#
mail.debug /var/adm/syslog/mail.log
*.info;mail.none /var/adm/syslog/syslog.log
*.alert /dev/console
*.alert root
*.emerg;*.alert;*.crit /Admin/monitor/system.log
*.emerg *
------------------------------
root>>syslogd -d -D
flags = 0200000
flags = 0200000
syslogd: syslog/udp: unknown service
logmsg: pri 53, flags 8, from safari, msg syslogd: syslog/udp: unknown service
getservbyname failed
off & running....
init
Inside full flush
cfline(mail.debug /var/adm/syslog/mail.log)
syslogd: unknown priority name "log"
logmsg: pri 53, flags 8, from safari, msg syslogd: unknown priority name "log"
cfline(*.info;mail.none /var/adm/syslog/syslog.log)
syslogd: unknown priority name "log"
logmsg: pri 53, flags 8, from safari, msg syslogd: unknown priority name "log"
cfline(*.alert /dev/console)
cfline(*.alert root)
cfline(*.emerg;*.alert;*.crit /Admin/monitor/system.log)
syslogd: unknown priority name "log"
logmsg: pri 53, flags 8, from safari, msg syslogd: unknown priority name "log"
cfline(*.emerg *)
X X 7 X X X X X X X X X X X X X X X X X X X X X X UNUSED:
6 6 X 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 X UNUSED:
1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 X CONSOLE: /dev/console
1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 X USERS: root,
2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 X UNUSED:
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 X WALL:
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 UNUSED:
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 UNUSED:
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 UNUSED:
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 UNUSED:
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 UNUSED:
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 UNUSED:
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 UNUSED:
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 UNUSED:
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 UNUSED:
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 UNUSED:
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 UNUSED:
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 UNUSED:
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 UNUSED:
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 UNUSED:
logmsg: pri 56, flags 8, from safari, msg syslogd: restart
Logging to UNUSED
syslogd: restarted
readfds = 0x68 0x3 0xffffffff 0x6 0x5
syslogd: going down on signal 2
Inside full flush
syslogd: going down on signal 2
logmsg: pri 53, flags 8, from safari, msg syslogd: going down on signal 2
Logging to UNUSED

[Steven E. Protter]

Seems that syslog.conf has been modified and a mistake has been built in.

I recommend restoring the file from a working system.

/sbin/init.d/syslogd start

SEP

[천순철_2]

i copied conf file from working system..
and restart syslogd ,, but it still not working..

root#>> syslogd -d -D
my system message
->logmsg: pri 53, flags 8, from safari, msg syslogd: syslog/udp: unknown :

normal system message..
->logmsg: pri 53, flags 8, from stsvc, msg syslogd: bind: Address already in use

i think a resolution in this message..

[Sridhar Bhaskarla]

Hi,

You will need to restart syslogd. So, do

/sbin/init.d/syslogd stop

Make sure syslogd is not running

ps -ef|grep syslogd

If running, kill it (using kill )

/sbin/init.d/syslogd start

If you still get syslog unknown service messages, then look at /etc/services file to ensure you have syslog entries.. If not add them just like the other host.

-Sri

[D Block 2]

If you want 'syslogd' to read your /etc/syslog.conf changes, you can send the syslogd process a -HUP signal.

ps -ef|grep syslogd

kill -HUP

also, open another window on unix and do
a tail -f of the syslog file:

tail -f /var/adm/syslog/syslog.log

[Steven E. Protter]

You copied the file, but did no indicate if you restarted the daemon.

Its important to use a working conf file and restart the daemon. The conf file alone is not enough.

At this point, I'd look for trouble:

bdf
are all filesystems, especially /var mounted, if not correct.

Perhaps fire up cstm mstm xstm excersize all your hardware and look for issues.

Restart your system now that that conf file is replaced and see what happens. Also instread of a "working" syslog.conf file, perhaps just a generic one. Seems you may have been cooking without testing.

Maybe not.

Anyway, thanks for the 3 points let me know if I can help more.

SEP

[천순철_2]

Thanks for your help.. but i still in trouble..

1. check system conf file
: /etc/service syslog.conf
/sbin/init.d/syslogd
-copy nomal systemfile
2. restart syslogd daemon
-kill -HUP
:tail -f /var/adm/syslog/syslog.log
-/sbin/init.d/syslogd start
3.tail -f /var/adm/syslog/syslog.log
-telnet another session
=>i can't find /var/run/syslog.pid, but
ps -ef|grep syslogd : syslogd is exist

- to Protter
% /var file system already mounted
% there is no h/w issue in stm
% i can't restart my system..

but, i still get a message "unknown service
"
What can i do??

[Sridhar Bhaskarla · Accepted solution]

Hi,

OK. You don't have a syslogd process running now right?.

Try this.

#mv /etc/syslog.conf /etc/syslog.conf.old
Get a fresh syslog configuration file.
#cp -Rp /usr/newconfig/etc/syslog.conf /etc
#grep syslog /etc/services

Ensure you have an entry like this
syslog 514/udp

Make sure the permissions on /etc/services are like below
-r--r--r-- 1 bin bin 11742 Jun 10 2003 /etc/services

Start syslogd daemon
#syslogd

See if it is running and logging.

-Sri

[천순철_2]

OK..i try again..

1./usr/newconfig/etc]cp -p syslog.conf /etc/syslog.conf

2.grep syslog /etc/services
syslog 514/udp # remote system logging

3. -r--r--r-- 1 bin bin 9535 11ì 15ì ¼ 07:57 /etc/services

4. touch /var/run/syslog.pid
5. kill -HUP `cat /var/run/syslog.pid`

6. & restart syslogd

7. NOW .. get a messages "Nov 15 08:23:55 sinsa syslogd: restart"

and, Telnet another session to test syslogd daemon. but any other messages in syslog.log file.. Now is it working well ??
How can i test my syslogd daemon??

Something Wrong in my /etc/syslog.conf file - i guess

Well. Near the succes

[천순철_2]

NOW. i get a messages nomally..
Thanks for your helps..

[천순철_2]

1. cp /usr/newconfig/etc/syslog.conf /etc/syslog.conf

2.kill -HUP `cat /var/run/syslog.pid`

3./usr/sbin/syslogd -D

4. tail -f /var/adm/syslog.log