How to clean up /var/log/messages ?

JaBa · 10-19-2004, 01:56 PM

I am unable to clean up /var/log/messages
Looks like it is locked by some process(es)

I am using Redhat 9.

I tried this:

stopped the syslog service

echo > /var/log/messages

this gives an 'operation not permitted'

echo >> /var/log/messages

is no problem (adding a line to the file).

ls -la gives:

-rw------- 1 root root 170312759 Oct 19 19:42 messages

I would be grateful for any suggestions.

Regards.

JaBa

jim mcnamara · 10-19-2004, 01:59 PM

lsof will show you which process(es) have the file open.

JaBa · 10-19-2004, 02:12 PM

Thank you Jim .

lsof gives:
COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME
syslogd 10574 root 2w REG 9,1 170364313 1880763 /var/log/messages

so i stop the syslog daemon:
service syslog stop

then lsof /var/log/messages gives nothing, so i try again:

echo > /var/log/messages
or
rm /var/log/messages

but i am still unable to remove or clean up
the file /var/log/messages.

hw-tph · 10-19-2004, 06:21 PM

Use logrotate to compress and archive old logs from time to time (put it in a cron job and be done with it) and start over with a new empty one. This goes not only for the syslog but other logs as well (mailers, and so on).

Håkan

JaBa · 10-21-2004, 05:47 AM

TY Håkan.

I already use logrotate for the log files, everything is running fine there except for /var/log/messages.

trickykid · 10-21-2004, 08:13 AM

Quote:

Originally posted by JaBa
TY Håkan.

I already use logrotate for the log files, everything is running fine there except for /var/log/messages.

Well, fix your logrotate scripts to include messages, etc..

Its controlled by syslog, so if most of the other files are getting rotated out and writing after syslog is restarted, I see no reason why messages wouldn't work as well.

JaBa · 10-29-2004, 02:46 AM

This is my workaround:

I restart Redhat in the 'rescue' mode and mounted the partition (read/write) under /mnt/sysimage, but even then it is not possible to remove the file /var/log/messages (/mnt/sysimage/var/log/messages).

I renamed the log-directory to oldlog and created a new log-dir, rebooted the server and now it is possible to remove the 'new' log file from /var/log/messages, but it is still not possible to remove the file /var/oldlog/messages.

Is this a corrupt file ? Does anyone know how to deal with these files ??

trickykid · 10-29-2004, 07:38 AM

Quote:

Originally posted by JaBa
This is my workaround:

I restart Redhat in the 'rescue' mode and mounted the partition (read/write) under /mnt/sysimage, but even then it is not possible to remove the file /var/log/messages (/mnt/sysimage/var/log/messages).

I renamed the log-directory to oldlog and created a new log-dir, rebooted the server and now it is possible to remove the 'new' log file from /var/log/messages, but it is still not possible to remove the file /var/oldlog/messages.

Is this a corrupt file ? Does anyone know how to deal with these files ??

I think you took about 10 steps too many and 30 minutes that should have taken you 3 steps and 2 minutes..

Of course messages is going to be locked, its usually gettin written to quite often. What you should have done was stop syslogd, remove file, restart syslogd.

And now if you never want to encounter this problem again, setup and configure logrotate properly, it will do all of this for you.. (even without rebooting your system)

JaBa · 10-29-2004, 12:01 PM

Quote:

Originally posted by trickykid
I think you took about 10 steps too many and 30 minutes that should have taken you 3 steps and 2 minutes..

Of course messages is going to be locked, its usually gettin written to quite often. What you should have done was stop syslogd, remove file, restart syslogd.

And now if you never want to encounter this problem again, setup and configure logrotate properly, it will do all of this for you.. (even without rebooting your system)

Trickykid:

Thanks for your reply, but:

-i already used logrotate and it did work for about half a year very well (for all log-files).
-i know that you should stop de syslog daemon first, before you can dan anything to the file (messages).

I experienced problems with the file a couple of weeks ago, the other log-files are not having the problem, logrotate works still fine for these.

ugge · 10-29-2004, 12:39 PM

Did you check if there were any attributes set for the directory/file?
lsattr
The existence of attributes are often forgot about. They are actually quite handy sometimes.

bigrigdriver · 10-30-2004, 12:32 AM

Echo > /var/log/messages (ditto >>) won't clean up anything. The > is a re-direct to send something to /var/log/messages. The clean messages up (I assume you mean to clean out the file and leave an empty file), do this: su to root, then /dev/null > /var/log/messages. This command basically says to overwrite messages with nothing (leaves an empty file).