LinuxQuestions.org
LinuxAnswers - the LQ Linux tutorial section.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Software
User Name
Password
Linux - Software This forum is for Software issues.
Having a problem installing a new program? Want to know which application is best for the job? Post your question in this forum.

Notices

Reply
 
Search this Thread
Old 11-14-2007, 05:43 AM   #1
turbo_acura
Member
 
Registered: Sep 2004
Location: London, UK
Posts: 95

Rep: Reputation: 15
/var/log/messages empty


Hello!

/var/log/messages and many other log files in /var/log are empty. What could be causing this? Running RHEL4 Update 4. Kernel 2.6.9-42.0.3.ELsmp (64-bit).

Thanks!
 
Old 11-14-2007, 05:54 AM   #2
colucix
Moderator
 
Registered: Sep 2003
Location: Bologna
Distribution: CentOS 6.5 OpenSuSE 12.3
Posts: 10,490

Rep: Reputation: 1956Reputation: 1956Reputation: 1956Reputation: 1956Reputation: 1956Reputation: 1956Reputation: 1956Reputation: 1956Reputation: 1956Reputation: 1956Reputation: 1956
Is the syslog daemon up and running? You may check
Code:
/etc/init.d/syslog status
 
Old 11-14-2007, 05:56 AM   #3
keratos
Member
 
Registered: May 2007
Location: London, UK.
Distribution: Major:FC8. Others:Debian;Zenwalk; Arch; Slack; RHEL.
Posts: 544

Rep: Reputation: 30
syslog and klog are the logging daemons.

is your syslog running and are the daemons you are running, writing to it?
 
Old 11-14-2007, 07:15 AM   #4
turbo_acura
Member
 
Registered: Sep 2004
Location: London, UK
Posts: 95

Original Poster
Rep: Reputation: 15
syslog service is running..not sure how I would tell if its writing to it, other then a timestamp of Nov.11 04:02 and the other ones /var/log/messages.1, /var/log/messages.2 ....are showing timestamps of Nov.4, October 28....but they're all blanks.

[root@server ~]# service syslog status
syslogd (pid 4189) is running...
klogd (pid 4193) is running...
[root@server ~]#
 
Old 11-14-2007, 07:38 AM   #5
rjlee
Senior Member
 
Registered: Jul 2004
Distribution: Ubuntu 7.04
Posts: 1,990

Rep: Reputation: 67
It's not surprising to see the backup files messages.1 etc as these are created by the logrotate daemon, which doesn't know anything about syslog.

It sounds like you have a configuration problem in syslog itself; take a look at your /etc/syslog.conf file and check that it has an entry for /var/log/messages. This will vary between distributions but it should look something like this:
Code:
*.info;mail.none;authpriv.none;cron.none                /var/log/messages
(line taken from a random FC5 machine)

If the line starts with a # sign then it's been commented out (in which case, remove the # sign, save the file and restart syslogd).

If you want to know more about configuring syslog then type
Code:
man syslog.conf
Feel free to post the file if you don't know what's wrong.

Hope that helps,

—Robert J Lee
 
Old 11-14-2007, 07:46 AM   #6
turbo_acura
Member
 
Registered: Sep 2004
Location: London, UK
Posts: 95

Original Poster
Rep: Reputation: 15
thank u for quick reply! I have checked the syslog.conf file already actually, but here it is anyways...

[root@server ~]# more /etc/syslog.conf
# Log all kernel messages to the console.
# Logging much else clutters up the screen.
#kern.* /dev/console

# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;mail.none;authpriv.none;cron.none /var/log/messages

# The authpriv file has restricted access.
authpriv.* /var/log/secure

# Log all the mail messages in one place.
mail.* -/var/log/maillog


# Log cron stuff
cron.* /var/log/cron

# Everybody gets emergency messages
*.emerg *

# Save news errors of level crit and higher in a special file.
uucp,news.crit /var/log/spooler

# Save boot messages also to boot.log
local7.* /var/log/boot.log
[root@server ~]#
 
Old 11-14-2007, 08:38 AM   #7
colucix
Moderator
 
Registered: Sep 2003
Location: Bologna
Distribution: CentOS 6.5 OpenSuSE 12.3
Posts: 10,490

Rep: Reputation: 1956Reputation: 1956Reputation: 1956Reputation: 1956Reputation: 1956Reputation: 1956Reputation: 1956Reputation: 1956Reputation: 1956Reputation: 1956Reputation: 1956
syslog.conf looks right. Maybe the syslog daemon was interrupted (crashed) for some reason and it lost the file descriptors of the log files, so that it is unable to send messages to the proper locations. You can try to restart the daemon via the service management or by the command
Code:
kill -1 `cat /var/run/syslogd.pid`
this will send an hang-up signal (SIGHUP) which will force syslogd to close the log files, re-read the configuration and open the log files again.
 
Old 11-14-2007, 09:00 AM   #8
turbo_acura
Member
 
Registered: Sep 2004
Location: London, UK
Posts: 95

Original Poster
Rep: Reputation: 15
Thanks for your assistance, but the file is still empty. I've gone to the console and noticed the message now appears 'syslogd: network logging disabled(syslog/udp service unknown).

I'm not 100% after the 'syslog/' above because the screen disappeared, but i believe I got the whole error message right. I'll try to google this and maybe this gives us more clues?


Thanks!
 
Old 11-23-2007, 08:07 AM   #9
turbo_acura
Member
 
Registered: Sep 2004
Location: London, UK
Posts: 95

Original Poster
Rep: Reputation: 15
got the fix...SELinux was enabled and disabling this fixed. All the logs in /var/log FINALLY started to get information! Thanks for your help...hope this helps you...
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Empty /var/log/messages jstencil Slackware 1 10-13-2006 09:34 AM
/var/log/messages is empty, and also dmesg shows nothing beagle2 Linux - General 5 11-08-2005 08:12 AM
Redirecting the kernel messages to file other than /var/log/messages jyotika_b83 Linux - General 3 04-28-2005 06:39 PM
/var/log/messages empty Phathead Slackware 5 12-13-2004 11:43 AM
/var/log/messages full of these messages. Should I be concerned? mdavis Linux - Security 5 04-16-2004 10:08 AM


All times are GMT -5. The time now is 07:26 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration