| unSpawn |
08-08-2008 10:07 AM |
There's a few ways to get more info. One could be to search Linuxquestions.org and the CentOS bug tracker, mailing lists and forum for similar problems. If that doesn't yield anything expand search to Red Hat and other OS sources. If that doesn't yield anything then you've covered everything that could be faster and more efficient and we'll try to work it out ourselves. BTW, does klogd run OK? Your syslogd PID 2045 shows it hasn't opened /dev/log. As root account user, notice the commandline of your running syslog ('pgrep -lf syslogd'), kill it (don't use '/etc/init.d/syslogd stop': keep klogd running), then try to start syslogd from the commandline as '/usr/bin/strace -v -o /tmp/syslog.strace /sbin/syslogd', adding these: "-f /etc/syslog.conf -d -a /dev/log 2>&1 | tee /tmp/syslog.tee" to your default switches to force it to read syslog.conf, enter debug mode and stay in the foreground, force it to use /dev/log and copy stdout and stderr to the file /tmp/syslog.tee. In another terminal screen execute 'pkill -USR1 -f /sbin/syslogd' to make it spit out debug messages if it doesn't already, then type 'logger PING', then type '( \ps axZ|grep syslogd; \ls -alZ /etc/syslog.conf /dev/log /sbin/syslogd; rpm -qVv sysklogd; /usr/sbin/lsof -w -n +D /var/log; \ls -aldZ / /var /var/log /var/log/messages; ) | tee /tmp/syslog.attr'. Now switch back to the first terminal window and CTRL+C to kill strace, then '/etc/init.d/syslogd restart'. Now you have three logs: /tmp/syslog.{tee,strace,attr} to read.
If reading those logs doesn't work for you (and I guess it's a wee bit too much lines to post here?) please upload logs as tarball to some free hoster and post the URI here. Before doing so replace any information in your logs if you need to but please don't delete lines unless you know for certain it won't affect log diagnosis.
|
