CentOS - Jun 2007 - empty /var/log/messages

I have one centos 4.0 server which /var/log/messages was always empty (0
bytes). I wonder what has been blocking the syslog to write the log.

Other (syslog) log files are fine, only messages.

/etc/syslog.conf:
# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;mail.none;authpriv.none;cron.none;spampd.none    -/var/log/messages


.thanks

beast wrote:
> I have one centos 4.0 server which /var/log/messages was always empty (0
> bytes). I wonder what has been blocking the syslog to write the log.
> 
> Other (syslog) log files are fine, only messages.
> 
> /etc/syslog.conf:
> # Log anything (except mail) of level info or higher.
> # Don't log private authentication messages!
> *.info;mail.none;authpriv.none;cron.none;spampd.none    -/var/log/messages
How is the selinux stuff on /var/log/messages?

# ll -Z /var/log/messages
-rw-------  root root system_u:object_r:var_log_t      /var/log/messages

-Andy

> I have one centos 4.0 server which /var/log/messages was always empty (0
> bytes). I wonder what has been blocking the syslog to write the log.
>
Firstly, I'd suggest updating to 4.5.

Secondly, is /tmp mounted with noexec option?


Se?n

On 6/26/07, beast <beast at ldap.or.id> wrote:
> I have one centos 4.0 server which /var/log/messages was always empty (0
> bytes). I wonder what has been blocking the syslog to write the log.
Is this an actual 4.0 system, or have you stayed current on updates?
Run 'cat /etc/redhat-release' to verify.

-- 
During times of universal deceit, telling the truth becomes a revolutionary act.
George Orwell

On Tuesday 26 June 2007, beast wrote:
> > On 26/06/07 13:42 +0100, Se?n O Sullivan wrote:
>   
>>>> > >>> I have one centos 4.0 server which
/var/log/messages was always
>>>> > >>> empty (0 bytes). I wonder what has been
blocking the syslog to write
>>>> > >>> the log.
>>>>         
>>> > >>
>>> > >> Firstly, I'd suggest updating to 4.5.
>>>       
> >
> > This is the production machine and has been runing for years, so
> > upgrading OS is not not my first option  :) 
> >
>   
>>> > >> Secondly, is /tmp mounted with noexec option?
>>>       
> >
> > No afaik.
> >
> > root# mount | grep var
> > /dev/hda4 on /var type ext3 (rw)
> >
>   
>> > >forgot to add, check /var/log/messages.* for current syslog
messages
>>     
> >
> > root# ls -l messages*
> > -rw-------  1 root root        0 Jun 25 11:11 messages
> > -rw-------  1 root root 32480831 Jun  3 00:04 messages.1.gz
> > -rw-------  1 root root 81601061 May 27 00:13 messages.2.gz
> > -rw-------  1 root root   905460 May 20 00:01 messages.3.gz
> > -rw-------  1 root root  1055604 May 13 00:01 messages.4.gz
> >
> > Note: previous messages.gz was having gigantic size because recent bug
> > in spamassassin, it logs all spampd log thats why I disable it on the
> > syslog.conf. But after few days I notice that messages were always
> > empty, even I restart syslog and then mv and touch messages
> >
>   
>From my own experience there is one trivial way to cause this.  How much
space is left on whatever partition /var is mounted on?  Your comment about SA
causing the huge log reminded me of the time I filled /var due to spewage from a
bad configuration.
Cheers,
Dave

-- 
Politics, n. Strife of interests masquerading as a contest of principles.
-- Ambrose Bierce