- Community Home
- >
- Servers and Operating Systems
- >
- Operating Systems
- >
- Operating System - HP-UX
- >
- /var/adm/syslog/mail.log and syslog.log not updati...
Categories
Company
Local Language
Forums
Discussions
Forums
- Data Protection and Retention
- Entry Storage Systems
- Legacy
- Midrange and Enterprise Storage
- Storage Networking
- HPE Nimble Storage
Discussions
Discussions
Discussions
Discussions
Forums
Forums
Discussions
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
- BladeSystem Infrastructure and Application Solutions
- Appliance Servers
- Alpha Servers
- BackOffice Products
- Internet Products
- HPE 9000 and HPE e3000 Servers
- Networking
- Netservers
- Secure OS Software for Linux
- Server Management (Insight Manager 7)
- Windows Server 2003
- Operating System - Tru64 Unix
- ProLiant Deployment and Provisioning
- Linux-Based Community / Regional
- Microsoft System Center Integration
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Community
Resources
Forums
Blogs
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Printer Friendly Page
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО10-08-2009 07:12 AM
тАО10-08-2009 07:12 AM
I was just doing a general scoot around the system and noticed the following files have not been updated in a few months - Anyone any ideas ? - I have no space issues at all
-r--r--r-- 1 root root 28050618 Aug 13 16:03 mail.log
-rw-r--r-- 1 root root 98776950 Aug 13 16:29 syslog.log
Solved! Go to Solution.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО10-08-2009 07:19 AM
тАО10-08-2009 07:19 AM
Re: /var/adm/syslog/mail.log and syslog.log not updating
This sounds as if someone tried to trim (null) the files by moving the current file to "*.old" and then touching (or redirecting '/dev/null' into a new file). This leaves the open file descriptor pointing at the ".old" file.
The correct way to preserve data and trim to zero bytes is to 'cp' the current file as "*.old" and then redirect (truncate) the current file.
Regards!
...JRF...
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО10-08-2009 07:29 AM
тАО10-08-2009 07:29 AM
Re: /var/adm/syslog/mail.log and syslog.log not updating
Pete
Pete
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО10-08-2009 05:47 PM
тАО10-08-2009 05:47 PM
Re: /var/adm/syslog/mail.log and syslog.log not updating
#logger "checking if its working"
BR,
Kapil+
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО10-08-2009 06:07 PM
тАО10-08-2009 06:07 PM
Re: /var/adm/syslog/mail.log and syslog.log not updating
>>I have no space issues at all
If you have not a space issue problem then you can leave those files as they are.
If you want to trim those files then you can take a backup copy of them and trim the file.
>mail.log
>syslog.log
Suraj
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО10-09-2009 12:55 AM
тАО10-09-2009 12:55 AM
Re: /var/adm/syslog/mail.log and syslog.log not updating
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО10-09-2009 01:15 AM
тАО10-09-2009 01:15 AM
Re: /var/adm/syslog/mail.log and syslog.log not updating
You could use lsof to see where it is writing.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО10-10-2009 03:51 AM
тАО10-10-2009 03:51 AM
SolutionYou can see /etc/syslog.conf there is you can find what logs are going where.
Restart syslog daemon and sendmail daemon
/sbin/init.d/syslog.d stop
/sbin/init.d/syslog.d start
/sbin/init.d/sendmail stop
/sbin/init.d/sendmail start
this should rename the current file to old one and restart writing the fresh syslgo.log file, then using logger message command check if it is logging OK in the syslog.log file with correct date.
If still does not help try ftping syslogn.conf file from another working system and restart the daemons, this should help.
also , I know its stupid but check the date of your system as you said your mails are still working.
Thanks
Raj
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО10-10-2009 04:16 PM
тАО10-10-2009 04:16 PM
Re: /var/adm/syslog/mail.log and syslog.log not updating
Always test syslogd with logger as mentioned above. These two commands will put an entry at the end of the two logs (assuming you have a standard syslog.conf file):
logger "testing syslog.log"
logger -p mail.info "testing mail.log"
If nothing shows up, then syslogd is not running or not writing to the current syslog.log and mail.log files. Stop and restart syslogd and repeat the logger test. If logger still does not write anything new, then list the syslog.conf file using cat -t:
cat -t /etc/syslog.conf
mail.debug^I^I/var/adm/syslog/mail.log
*.info;mail.none;local5.none;auth.none^I/var/adm/syslog/syslog.log
auth.info^I^I/var/adm/syslog/auth.log
local5.info^I^I/var/adm/syslog/ftpd.log
*.alert^I^I^I/dev/console
*.alert^I^I^Iroot
*.emerg^I^I^I*
There must be *NO* spaces anywhere in the file. The ^I symbol is the TAB character but in vi, it looks like spaces. This space character restriction has always existed for syslogd.
Bill Hassell, sysadmin
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО10-13-2009 05:27 AM
тАО10-13-2009 05:27 AM
Re: /var/adm/syslog/mail.log and syslog.log not updating
kilhp01:/ # /sbin/init.d/syslogd start
System message logger started
kilhp01:/ #
kilhp01:/ # /sbin/init.d/sendmail stop
Sendmail pid is 1253
Killing sendmail
Please wait .....
Sendmail killed.
kilhp01:/ # /sbin/init.d/sendmail start
/etc/mail/aliases: 7 aliases, longest 9 bytes, 88 bytes total
sendmail
kilhp01:/ # pwd
/
kilhp01:/ # cd /var/adm/syslog
kilhp01:/var/adm/syslog #
kilhp01:/var/adm/syslog #
kilhp01:/var/adm/syslog # ls -al
total 247776
dr-xr-xr-x 2 bin bin 96 Oct 13 14:21 .
drwxr-xr-x 15 adm adm 8192 Apr 2 2008 ..
-rw-r--r-- 1 root root 98776950 Aug 13 16:29 OLDsyslog.log
-r--r--r-- 1 root root 28050618 Aug 13 16:03 mail.log
-rw-r--r-- 1 root sys 0 Oct 13 14:21 syslog.log
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО10-13-2009 05:44 AM
тАО10-13-2009 05:44 AM
Re: /var/adm/syslog/mail.log and syslog.log not updating
> looks like its created a new syslog.log , but the mail file looks the same one
Re-read Bill's comments about 'syslog.conf'. You can NOT use _spaces_ to delineate fields. You must use _tab_ characters instead. You can examine your 'syslog.conf' by doing:
# cat -etv /etc/syslog.conf
This will expose TAB characters and allow you to easily differentiate them from SPACEs.
Regards!
...JRF...
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО10-13-2009 05:59 AM
тАО10-13-2009 05:59 AM
Re: /var/adm/syslog/mail.log and syslog.log not updating
kilhp01:/var/adm/syslog # ls -al
total 269216
dr-xr-xr-x 2 bin bin 96 Oct 13 14:21 .
drwxr-xr-x 15 adm adm 8192 Apr 2 2008 ..
-rw-r--r-- 1 root root 98776950 Aug 13 16:29 OLDsyslog.log
-r--r--r-- 1 root root 28051458 Oct 13 14:31 mail.log
-rw-r--r-- 1 root sys 10974254 Oct 13 14:41 syslog.log
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО10-15-2009 02:32 AM
тАО10-15-2009 02:32 AM
Re: /var/adm/syslog/mail.log and syslog.log not updating
-rw-r--r-- 1 root sys 856953472 Oct 14 15:30 syslog.log
-rw-r--r-- 1 root sys 1471363724 Oct 15 11:12 syslog.log
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО10-15-2009 02:45 AM
тАО10-15-2009 02:45 AM
Re: /var/adm/syslog/mail.log and syslog.log not updating
Most likely it is the reason the syslog daemon was turned off in the first place.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО10-15-2009 02:50 AM
тАО10-15-2009 02:50 AM
Re: /var/adm/syslog/mail.log and syslog.log not updating
Oct 15 11:45:35 kilhp01 vmunix: function == 0x7A8E80, arg == 0x416C3400, ticks =
= 0xDF234640, flags == 0x0
Oct 15 11:45:35 kilhp01 vmunix: function == 0x7A8E80, arg == 0x416C3400, ticks =
= 0xDF23463F, flags == 0x0
Oct 15 11:45:35 kilhp01 vmunix: function == 0x7A8E80, arg == 0x416C3400, ticks =
= 0xDF23463E, flags == 0x0
Oct 15 11:45:35 kilhp01 vmunix: function == 0x7A8E80, arg == 0x416C3400, ticks =
= 0xDF23463D, flags == 0x0
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО10-15-2009 03:21 AM
тАО10-15-2009 03:21 AM
Re: /var/adm/syslog/mail.log and syslog.log not updating
Dont go by the block size there run du -sk command to see the actual usage.
cd /var/adm/syslog/
du -sk *|sort -n
This is all mounted under /var. I think u should be only worried if there is a space issue with /var fs does it keep on feeling etc?
if no and the growth is normal and don't worry also if you want to do some houskeeping on this file using some script evrryday you can rename as per the date wise and start new systlog file and after 7 days delet the files.
if there is space issue with /var.
1st you should look if , is it syslog.log causing issue or something else.
u can find out the space utilization using the commands given above.
cd /var
du -sk * |sort -n
(above command will give you the space utilization in sorted way) u can go in high utilization dir and run the same command to see which is using most and if there is anything whcih can be deleted.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО10-15-2009 03:43 AM
тАО10-15-2009 03:43 AM
Re: /var/adm/syslog/mail.log and syslog.log not updating
There is definitely something wrong in the kernel. You should seriously look into installing some patches (SCSI) on this server.
Take a look at these threads
https://forums11.itrc.hp.com/service/forums/questionanswer.do?threadId=1236170
http://forums11.itrc.hp.com/service/forums/questionanswer.do?threadId=1167624
I think it would be wise to turn of the sysolgd at this time before it filles up your disk. You have enough error messages to check the error with HP if needed. When you have fixed the error you can turn on syslogd again.