LinuxQuestions.org
Share your knowledge at the LQ Wiki.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices


Reply
  Search this Thread
Old 07-29-2006, 01:40 AM   #1
dan451
LQ Newbie
 
Registered: Nov 2003
Posts: 8

Rep: Reputation: 0
cannot delete or rotate messages log file


Hey Now People,

So suddenly, with out warning, my messages system log file grew to 300 megabytes. Filling my root system partition. Ahhhhhhhh!

Now my email does not work oh!

I try to delete this file. I'm in as root but I get permission denied!

What I really want to do is split this file. Say 299.9 megabytes to some other file that I will archive and let the rest live happaly every after.

Any ideas?

Thanks
Danny
 
Old 07-29-2006, 03:52 AM   #2
konsolebox
Senior Member
 
Registered: Oct 2005
Distribution: Gentoo, Slackware, LFS
Posts: 2,248
Blog Entries: 8

Rep: Reputation: 235Reputation: 235Reputation: 235
hey how 'bout booting your livecd then remove the file there.
 
Old 07-29-2006, 04:32 PM   #3
dan451
LQ Newbie
 
Registered: Nov 2003
Posts: 8

Original Poster
Rep: Reputation: 0
didn't work

That was a good try.

My system is an old p100. I used floppies not a cd. Anyway. I mounted my paritition and got to my file but was not able to delete it or split it.

Permission denyied

Any ideas?

Thanks
Danny
 
Old 07-29-2006, 05:57 PM   #4
konsolebox
Senior Member
 
Registered: Oct 2005
Distribution: Gentoo, Slackware, LFS
Posts: 2,248
Blog Entries: 8

Rep: Reputation: 235Reputation: 235Reputation: 235
how bout trying to boot your system in single-user mode. you can do that by adding the kernel parameter 'single' at boot.

refernces: http://www.redhat.com/docs/manuals/l...ng-single.html
http://linuxgazette.net/issue19/booting.html
 
Old 07-29-2006, 11:22 PM   #5
dan451
LQ Newbie
 
Registered: Nov 2003
Posts: 8

Original Poster
Rep: Reputation: 0
still cannot delete

Hey thanks for helpping me.

I booted in single user mode but I still could not delete, rename or split the file /var/log/messages.

Permission denied.

I used:

chattr +X <filename>
lsattr <filename>

to remove attributes as well but no luck.

This file was maybe 50 or 60 megs last week. It blew up all of a sudden.

My root partition is only 2 gig and now I only have 20 meg free.

Any ideas?

Thanks again
Danny
 
Old 07-30-2006, 12:14 AM   #6
konsolebox
Senior Member
 
Registered: Oct 2005
Distribution: Gentoo, Slackware, LFS
Posts: 2,248
Blog Entries: 8

Rep: Reputation: 235Reputation: 235Reputation: 235
perhaps there's a process accessing the file. type 'fuser -s 9 -k /var/log/messages' to kill the process then try to delete the file again.
 
Old 07-30-2006, 01:03 AM   #7
dan451
LQ Newbie
 
Registered: Nov 2003
Posts: 8

Original Poster
Rep: Reputation: 0
Well that's another good idea byting the dust.

fuser -s 9 -k /var/log/messages returns:

9: no such file or directory

And the file remains and still will not be deleted

Permission denied

I guess I got a good one.

Try again?

Thanks
Danny
 
Old 07-30-2006, 02:02 AM   #8
konsolebox
Senior Member
 
Registered: Oct 2005
Distribution: Gentoo, Slackware, LFS
Posts: 2,248
Blog Entries: 8

Rep: Reputation: 235Reputation: 235Reputation: 235
made a mistake here. it should be 'fuser -9 -k /var/log/messages'.
 
Old 07-30-2006, 02:06 PM   #9
dan451
LQ Newbie
 
Registered: Nov 2003
Posts: 8

Original Poster
Rep: Reputation: 0
Hey Now,

No that did not work either.

fuser -9 -k /var/log/messages

I looked at man fuser. I did not c the -9 parameter. It's an old slack version.

But another good try.
:-)

keep going?

Thanks again for u'r help

Danny
:-)
 
Old 07-30-2006, 02:20 PM   #10
konsolebox
Senior Member
 
Registered: Oct 2005
Distribution: Gentoo, Slackware, LFS
Posts: 2,248
Blog Entries: 8

Rep: Reputation: 235Reputation: 235Reputation: 235
Ok keep trying
Code:
killall -s 9 syslog syslog-ng
killall -s SIGKILL syslog syslog-ng
killall -9 syslog syslog-ng
 
Old 07-30-2006, 03:08 PM   #11
dan451
LQ Newbie
 
Registered: Nov 2003
Posts: 8

Original Poster
Rep: Reputation: 0
Interesting,

This did not work either.

killall -s 9 syslog syslog-ng
s: unknown signil; killall -l lists signals

killall -s SIGKILL syslog syslog-ng
s: unknown signil; killall -l lists signals

killall -9 syslog syslog-ng
syslog: no process killed
syslog-ng: no process killed

So I listed the signals with killall -l. SIGKIL was not there but KILL was there. So I tried it.
s: unknown signil; killall -l lists signals

Oh well.

hav u ever seen something like this before?

Thanks
Danny
 
Old 07-30-2006, 04:38 PM   #12
konsolebox
Senior Member
 
Registered: Oct 2005
Distribution: Gentoo, Slackware, LFS
Posts: 2,248
Blog Entries: 8

Rep: Reputation: 235Reputation: 235Reputation: 235
things are getting far too weird.
Code:
fuser /var/log/messages
kill -9 <shownpid>
where the shownpid is seen in the output of fuser

if nothing still works, please post the output of the ff. commands:
Code:
fuser; kill; killall; help kill; kill -l
Edit: mostly it is syslog-ng that handles /var/log/messages. you can also just type 'ps -A' then manually kill the process by the kill command. in kde, you can also use "Kde System Guard" by pressing <ctrl-esc> to kill the process.

Last edited by konsolebox; 07-30-2006 at 04:45 PM.
 
Old 07-31-2006, 09:44 PM   #13
dan451
LQ Newbie
 
Registered: Nov 2003
Posts: 8

Original Poster
Rep: Reputation: 0
Ok,

fuser /var/log/messages

returned nothing, another prompt. No process id - nothing. So I did not run kill -9 <showpid>.

if nothing still works, please post the output of the ff. commands:
fuser; kill; killall; help kill; kill -l

So I did this:
fuser; kill; killall; help kill; kill -1 > dannyFile

The contents of dannyFile was empty. Did I do this command wrong? It displayed a bunch at the console.

I use a program called webmin for my servers adminastration. When I ask it to show me the running process it says no process are running. I believe it is failing because the linux partition is down to 20 megabytes of disk space.

I still have web access and the apache server is running fine. I'm hoping that when I kill this messages file and get 300mg back it will all fix itself.

It also says my nfs server and Internet & RPC server are down. DO u think if I clear this messages file my process id's will come back to life?

Any ideas?

Thanks again
Danny
 
Old 07-31-2006, 10:01 PM   #14
konsolebox
Senior Member
 
Registered: Oct 2005
Distribution: Gentoo, Slackware, LFS
Posts: 2,248
Blog Entries: 8

Rep: Reputation: 235Reputation: 235Reputation: 235
Code:
fuser; kill; killall; help kill; kill -1 > dannyFile
should be

Code:
{ fuser; kill; killall; help kill; kill -1; } > dannyFile
also did you tried 'ps -A'? it should show the PID of syslog or syslog-ng
 
Old 08-04-2006, 04:13 PM   #15
dan451
LQ Newbie
 
Registered: Nov 2003
Posts: 8

Original Poster
Rep: Reputation: 0
Hello konsolebox and other that maybe looking at this,

It's been about 5 days.

Ok, below is the output of the script:
{ fuser; kill; killall; help kill; kill -1; } > dannyFile

But more is, happening.
This morning I my system console monitor had lit up with things like

Call Trace
Code: Bad EIP value
Segmentation fault

With values for things like
CPU: 0
EFLAGS: 0010246
process sendmail - yada yada yada
Stack: yada yada

And other pleasant messages.
The other process I've seen besides sendmail have been bash and mini server.

Amazingly, the server is still serving up web pages and routing the internet through out my house. But sendmail is down.

I'm getting ready to move everything to a new server. This is a very old machine. 10 years I think. In all this time linux has never crashed. Pretty cool huh? The version of this slackware-linux is pretty old too.

Anyway I would like to try and save this so any help is wonderful.

Below is the output of the previous commands:

kill: kill [-s sigspec | -n signum | -sigspec] [pid | job]... or kill -l [sigspec]
Send the processes named by PID (or JOB) the signal SIGSPEC. If
SIGSPEC is not present, then SIGTERM is assumed. An argument of `-l'
lists the signal names; if arguments follow `-l' they are assumed to
be signal numbers for which names should be listed. Kill is a shell
builtin for two reasons: it allows job IDs to be used instead of
process IDs, and, if you have reached the limit on processes that
you can create, you don't have to start a process to kill another one.

Thanks again for helping me

Danny
*****************************
Woops there is more,

I cannot shutdown or restart the server. My webmin program acts like it is waiting for the system to go down but it does not go down.

I tried "shutdown -r now" fron the command console and got a perminsion denied message.


Since then I had the idea that maybe I should log out. Now the console is not responding. Perhpes I should pull it's plug and reboot it.

Well I wait a little bit on that.

Thanks again
Danny

Last edited by dan451; 08-04-2006 at 04:29 PM.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Redirecting the kernel messages to file other than /var/log/messages jyotika_b83 Linux - General 3 04-28-2005 06:39 PM
can not clear log file messages mitch_lin Red Hat 2 04-25-2004 08:19 PM
Boot messages log file? JoshSmith41 Linux - General 3 04-08-2004 08:31 AM
syslog and firestarter - log messages to another file than messages mule Linux - Newbie 0 08-07-2003 03:35 AM
iptables, changing log file from /var/log/messages acid2000 Linux - Networking 3 03-11-2003 08:38 PM


All times are GMT -5. The time now is 12:53 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration