Something has killed any writes to /var/log/messages. Syslogd is running. Has been off for some time and I just discovered it. Any hints as to what / where to look since syslogd is running? Sam -- Sam W.Drinkard -- sam at wa4phy.net NOAA Cooperative Observer KAGS (snow) http://wa4phy.net Augusta Area Mesonet
> Something has killed any writes to /var/log/messages. Syslogd is > running. Has been off for some time and I just discovered it. Any > hints as to what / where to look since syslogd is running?Is the partition full? Are there any messages in the other logs such as audit or security? Does lsof say that anything has the file open? j
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On Tue, Jun 27, 2006 at 02:38:32PM -0400, Sam Drinkard wrote:> Something has killed any writes to /var/log/messages. Syslogd is > running. Has been off for some time and I just discovered it. Any > hints as to what / where to look since syslogd is running?Are you sure syslogd is not writing to /var/log/messages.1 ? Try: fuser /var/log/messages* - -- Rodrigo Barbosa "Quid quid Latine dictum sit, altum viditur" "Be excellent to each other ..." - Bill & Ted (Wyld Stallyns) -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.1 (GNU/Linux) iD8DBQFEoYVspdyWzQ5b5ckRAo8tAJ9+jiC4NqvJ3cTDtmIRUCxX/EgrwACgmqvr c1R9JwcrbZzEtPPH3+7twDU=N3NF -----END PGP SIGNATURE-----
> No joy. Q. I see a process called "klogd" is running a > different pid > from syslogd. I don't ever recall seeing something as klogd > before?? I > got a sneaking suspicion I stopped something, but if I only knew what > besides syslogd was required. Portmap does not apparently need to be > running, as nothing still has been written to the log file, > and a reboot > did not help. Rats..... >I know this won't help you now, but dconf is a great tool for dealing with exactly this type of situation. I have it configured to send an email every day from each server which tells me every config file that gets edited that day. Go back to the day something stopped working and voila. Hope you can figure your problem out. Alex Palenschat