syslogd terminated

[atul2701]

Hi

When i am trying to start the syslogd on my HP UX B.11.31 server it start and terminated immediately. I have tried to replace the /etc/syslog.conf file with /usr/newconfig/etc/syslog.conf.

# ps -ef |grep -i syslog
root 9925 11167 1 06:33:40 pts/0 0:00 grep -i syslog
# /sbin/init.d/syslogd stop
syslogd stopped
# /sbin/init.d/syslogd start
System message logger started
# tail /var/adm/syslog/syslog.log
May 11 06:33:58 whqwm03 syslogd: restart
May 11 06:33:58 whqwm03 syslogd: the kernel messages are already disabled: No such device or address
# cat /var/run/syslog.pid
10171
# ps -ef |grep -iE "10171|syslog"
root 10914 11167 0 06:35:01 pts/0 0:00 grep -iE 10171|syslog
#

[Mel Burslan]

Long, long time ago, I remember encountering a situation like this and the cause of mine being ended up whitespaces in the syslog.conf file instead of tabs. Field separators in syslog.conf file SHOULD BE s, NOT whitespaces.

when you said you copied the newconfig file, you just cat'ed the file and do a screen-scraping (click and drag highlight and copy) then paste into your editor session, what you might end up doing is introducing whitespaces.

If I were you, even if you did not do what I said, I'd check for the existence of whitespaces in this file. Just for precaution if nothing else.

[Michael Steele_2]

I believe you are on the right track with /usr/newconfig/etc/syslog.conf but I must believe that you have a whitespace or control char still in there.

Question: Did you update the default syslog.conf file or just copy it in?

b) try this

grep -v "^[[:blank:]]*$" syslog.conf > work_file
ls -la both files
cksum both files

Any difference? If so then use the work_file

[atul2701]

no luck...

# cd /etc
# grep -v "^[[:blank:]]*$" syslog.conf > work_file
# ls -la syslog.conf
-r--r--r-- 1 bin bin 250 May 12 01:30 syslog.conf
# ls -la work_file
-rw-r----- 1 root sys 250 May 12 01:47 work_file
# cksum syslog.conf work_file
3145885767 250 syslog.conf
3145885767 250 work_file

[atul2701]

no luck...

# cd /etc
# grep -v "^[[:blank:]]*$" syslog.conf > work_file
# ls -la syslog.conf
-r--r--r-- 1 bin bin 250 May 12 01:30 syslog.conf
# ls -la work_file
-rw-r----- 1 root sys 250 May 12 01:47 work_file
# cksum syslog.conf work_file
3145885767 250 syslog.conf
3145885767 250 work_file...

[Laurent Menase]

do you have any 3rd party pam or nss lib?
is there a core?

you can also try a tusc on it to see what it is doing.

[Duncan Edmonstone]

Michael,

>> grep -v "^[[:blank:]]*$" syslog.conf > work_file

I don't think that regexp is working as you expected - I just added some spaces to a copy of my syslog.conf file and ran it through it, and it didn't pick them up...

atgupta,

Maybe a simpler one, does:

grep ' ' /etc/syslog.conf

(that's a space between the quote ' symbols)

return anything that's not on a comment line?

HTH

Duncan

[atul2701]

Laurent@ bad luck tusc or any other utility is not installed..

Duncan@ grep " " /etc/syslog.conf i already tried and there was no space...

# grep ' ' /etc/syslog.conf
# @(#)B.11.31_LR
# syslogd configuration file.
# See syslogd(1M) for information about the format of this file.
#

[Michael Steele_2]

Well, I have to believe that this is for information only. Try running some LVM commands like:

vgscan -p -v -a
lvlnboot -R

...and post syslog.log afterwards.

[atul2701]

As syslogd terminated immediately after i start it hence its not loging anything in syslog.log...

[Michael Steele_2]

What are the error messages from dmesg?
What are the error messages on the console?

[Mel Burslan]

Just for the kick, instead of starting syslogd, using the init script, what happens if you start it directly from the command line as in

/usr/sbin/syslogd

without putting it in background (i.e. daemon mode) is it staying up or dying down immediately ?

Open another terminal window to the same system and run:

while true; do
ps -ef | grep syslogd
done

continuously. This will impact the performance more than likely. So, if this is a production system, you might want to do it after hours. Also capture the terminal session as the output will most probably flow too fast for your eyes to catch anything meaningful.

This may give you a bit more insight and won't hurt anything just by trying.

Just a thought

[Laurent Menase]

try to start /usr/sbin/syslogd -d

[atul2701]

all above things i have already tried and no luck..

when it dies its creating the core file..
# what core
core:
$ PATCH_11.31/PHCO_39177 May 21 2009 06:51:02 $
$ PATCH_11.31/PHCO_40292 Jul 6 2010 09:44:47 $
92453-07 linker dld HP Itanium(R) B.12.55
92453-07 linker uld HP Itanium(R) B.12.55
#

[atul2701]

Thanks all for your valuable time and support.. Finaly i got the solution.

Under syslog dir mail.log file size was 2Gb. i have trimmed the same and after that start the syslogd daemon and running fine..

Atul

[Ismail Azad]

Hey atgupta,

Well I guess the moral of this scenario turns out to be trimming certain stuff once in a while on the /var filesystem... Be it the syslog, or let's say the wtmps or btmps file. That's why on a server that you consider important it's momentous to check if the /var is reaching let's say 98% with very less free space left.

Regards
Ismail Azad

[atul2701]

Its not bcoz /var fs is running out of space. /var utilization was around 58% only.

there is a bug in 11.31 Syslogd is checking or calling mail.log. That’s the reason need to trim down some files with near or greater than 2GB or modifying the LOG_SIZE=NOLIMIT in /etc/defaults/syslogd file.