syslogd

[Leon Smith, Jr]

I am running 11.11 and just applied B.11.11.0706.467 Base Patches for HP-UX 11i v1, June 2007. when the server came back up I noticed / at 100% so I cleared out some useless files and brought it down to 77% the last entry in the sylog was about vx-nospace on rootvol and that was 3 days ago. I have bounced it several times and tested it with logger but still no updates. Please advise.

[Court Campbell]

When you say "bounce", do you mean the server or syslogd? Is /var full by chance? If you bounced syslogd, what steps did you use?

[Leon Smith, Jr]

I bounced it by first by killing syslogd -D pid then starting it with /sbin/init.d/syslogd start. after that I logger test and nothing.

[Ivan Krastev]

When /var is full syslogd cannot write and after clean up you need to restart it.

regards,
ivan

[Leon Smith, Jr]

Var is at 63%

[Sudalaimani]

Hi,

1. Look for any "core" files in the root FS, some times applications running as root will put core file, when it have issues
2. Verify all the FS which has other than root ownnership, are mounted ,If it is not mounted, the user will fill dir. which is sitting on the root FS.
3. Verify the entries under /etc/vlmconf - if you have too many VG's you may plan to move the *.old files to other location for temporarily
3. If you have "lsof" run it and collect the output in file and check the process size on FS- sometimes the process initiated from root FS will
temprarily use the root FS for its space requirement.

Finally you may consider extending the root FS, (online if you have using mirroring)

Hope this helps a bit

[Leon Smith, Jr]

My problem is not with the rootvol but with syslogd.

[Court Campbell]

try this:

# ps -ef | grep syslogd

see if it is even running. if not, then see if the file /var/run/syslog.pid exists and remove it. then try and start syslogd again.

[Leon Smith, Jr]

syslog is running but not logging.

[David Child_1]

You didn't mention modifying /etc/syslog.conf so this is probably a long shot, but...

Make sure that there aren't any entries using spaces instead of tabs. That will stop syslog from working correctly.

Perhaps when / filled up it corrupted /etc/syslog.conf.

It's worth a quick check.

David

[skt_skt]

do a lsof>lsof.out and see how many syslog.log is locked. Comapare with a working one.

what is the syslogd cuulative patch you have.