log files in /var/log stopped recording

log files in /var/log stopped recording

Post by mlade » Tue, 22 Apr 2003 06:23:32



On Debian, Woody, kernel 2.4.20 after the system was idle for
48 hours and 10 hours before I sat it, all log files in /var/log
(syslog, messages, auth etc.) stopped recording (except XFree86.0.log
and lastlog - which I do not know how to read).
I rebooted the machine twice but without a result: nothing was
recorded in any of the logs except in  XFree86.0.log.

How can I make the system write messages in log files again?

Is it a sign of some serious misfunctioning? So, far all the
programs and services are running OK.

Bellow is  ls -l /var/log taken 17:20 (some 10 hours after the
log files stopped recording)

-rw-r--r--    1 root     root        24730 Apr 20 17:11 XFree86.0.log
-rw-r-----    1 root     adm             0 Apr 20 06:48 auth.log
-rw-r-----    1 root     adm        207391 Apr 20 06:47 auth.log.0
-rw-r-----    1 root     adm         11044 Apr 13 06:47 auth.log.1.gz
-rw-r-----    1 root     adm             0 Apr 20 06:48 daemon.log
-rw-r-----    1 root     adm         20467 Apr 17 21:54 daemon.log.0
-rw-r-----    1 root     adm          2306 Apr 12 21:30 daemon.log.1.gz
-rw-r-----    1 root     adm             0 Apr 20 06:48 debug
-rw-r-----    1 root     adm         23631 Apr 18 02:59 debug.0
-rw-r-----    1 root     adm          2160 Apr 13 04:39 debug.1.gz
-rw-r--r--    1 root     root         7211 Apr 20 16:51 dmesg
-rw-r--r--    1 root     root        20444 Apr 20 17:11 isdnctrl
-rw-rw-r--    1 root     utmp       292584 Apr 20 17:01 lastlog
-rw-r-----    1 root     adm             0 Apr 20 06:48 messages
-rw-r-----    1 root     adm        193153 Apr 20 06:27 messages.0
-rw-r-----    1 root     adm         29516 Apr 13 06:27 messages.1.gz
-rw-r--r--    1 root     root         3889 Apr 20 16:51 netconf.log
-rw-r-----    1 root     adm           336 Apr 20 06:26 setuid.changes
-rw-r-----    1 root     adm           900 Apr 19 06:27 setuid.changes.0
-rw-r-----    1 root     adm           719 Apr 18 06:29
setuid.changes.1.gz
-rw-r-----    1 root     adm        485454 Apr 20 06:26 setuid.today
-rw-r-----    1 root     adm        485454 Apr 19 06:27 setuid.yesterday
-rw-rw-r--    1 root     dialout         0 Apr 20 06:48 smsclient.log
-rw-rw-r--    1 root     dialout         0 Apr 13 06:48 smsclient.log.0
-rw-rw-r--    1 root     dialout        36 Apr  7 22:38
smsclient.log.1.gz
-rw-r-----    1 root     adm           650 Apr 20 06:47 syslog
-rw-r-----    1 root     adm         30536 Apr 20 06:25 syslog.0
-rw-r-----    1 root     adm          1859 Apr 19 06:25 syslog.1.gz
-rw-r-----    1 root     adm             0 Apr 20 06:48 user.log
-rw-r-----    1 root     adm          1939 Apr 17 21:54 user.log.0
-rw-r-----    1 root     adm           789 Apr 12 21:30 user.log.1.gz

--
Direct access to this group with http://web2news.com
http://web2news.com/?comp.os.linux.misc

 
 
 

log files in /var/log stopped recording

Post by Michael Heimin » Tue, 22 Apr 2003 17:48:39



> On Debian, Woody, kernel 2.4.20 after the system was idle for
> 48 hours and 10 hours before I sat it, all log files in /var/log
> (syslog, messages, auth etc.) stopped recording (except XFree86.0.log
> and lastlog - which I do not know how to read).
> I rebooted the machine twice but without a result: nothing was
> recorded in any of the logs except in  XFree86.0.log.
> How can I make the system write messages in log files again?
> Is it a sign of some serious misfunctioning? So, far all the
> programs and services are running OK.

Looks like a problem while log-rotating, perhaps syslogd couldn't be
restarted. I'd check if it runs and take a look at:
/etc/logrotate.conf
/etc/logrotate.d/syslog

Might be in another place with your distro, try the docs.

--
Michael Heiming

Remove +SIGNS and www. if you expect an answer, sorry for
inconvenience, but I get tons of SPAM

 
 
 

log files in /var/log stopped recording

Post by Martin Blum » Tue, 22 Apr 2003 20:06:28




Quote:> On Debian, Woody, kernel 2.4.20 after the system was idle for
> 48 hours and 10 hours before I sat it, all log files in /var/log
> (syslog, messages, auth etc.) stopped recording (except XFree86.0.log
> and lastlog - which I do not know how to read).

lastlog can be read with the command lastlog, for details see man lastlog.
XFree86.0.log should be a straight ASCII text  file, no?

Quote:> How can I make the system write messages in log files again?

try the command
$ logger "i am alive"
this should show up in /var/log/messages. If not, perhaps logger tells you
why not.

Quote:> Is it a sign of some serious misfunctioning? So, far all the
> programs and services are running OK.

Problem with logrotate?
is syslogd running?
do
# ps -ef | grep syslogd

Quote:> -rw-r-----    1 root     adm             0 Apr 20 06:48 messages
> -rw-r-----    1 root     adm        193153 Apr 20 06:27 messages.0

logrotate would be invoked at bout 6:27. You could try to ascertain with
your cron setup.

Quote:> -rw-r-----    1 root     adm           650 Apr 20 06:47 syslog
> -rw-r-----    1 root     adm         30536 Apr 20 06:25 syslog.0

syslog, OTH, seems to be running. What's inside?
I haven't got a file syslog on my machine (i am using SuSE).

HTH
Martin