/var/adm/syslog/mail.log & syslog.log file problem

[roobala]

Dear All
HP 9000 L-1000 HPUX 11.00 Server working as a mail server Sendmail 8.8.6.

When we see today the
/var/adm/syslog/mail.log and /var/adm/syslog/syslog.log files are 0 bytes in size and the last time and date of modification is 27th November 12.30

There was no information how these 2 files became 0 bytes.

One more thing is if at all somebody made those files to 0 bytes by this time those files should grow(more than 30 hours over) but till now 2 files are 0 bytes. Mails are going without any problem

who -r gives some exciting output which I suspect , it may help to resolve this problem (See the attachment)

How to make the system to start log (mail.log and syslog.log).

Please help us to solve this issue

Thanks in Advance

Roobala

[CHRIS_ANORUO]

Hi roobala,

Check your crontab file to see if you have a command that will reduce files to zero form disk house keeping. (crontab -l). Look for a line like:
cat /dev/null > /var/adm/syslog/mail.log or syslog.log. This will zero the large files at 12:30 on the specified day in your cron file.

[Kofi ARTHIABAH]

To resume logging, you may have to restart sendmail and syslogd since the two programs seem not to be in "connection" with their log files.

# /sbin/init.d/sendmail stop ; /sbin/init.d/sendmail start
# /sbin/init.d/syslog stop ; /sbin/init.d/syslog start

[roobala]

Hi,

I already verified , there was no crontab entry as U said.
I can confirm this is not because of crontab

Roobala

[Kofi ARTHIABAH]

I believe if the files were deleted by a user, the user would have had to have root equivalence.

I would suggest searching each users' .sh_history file for any tell tale signs.

[Matjaz Obstetar]

Hi,

/etc/syslog.conf is a configuration file for syslog deamon. What is logging with syslog deamon is writen in this file. You should check if there is any entry about syslog.log and mail.log.

Default entries about mail.log and syslog.log are:

mail.debug /var/adm/syslog/mail.log

*.info;mail.none /var/adm/syslog/syslog.log