LinuxQuestions.org
Did you know LQ has a Linux Hardware Compatibility List?
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Distributions > Slackware
User Name
Password
Slackware This Forum is for the discussion of Slackware Linux.

Notices

Reply
 
Search this Thread
Old 04-15-2005, 04:20 AM   #1
Etraman
LQ Newbie
 
Registered: Dec 2004
Distribution: Slackware 10
Posts: 11

Rep: Reputation: 0
Syslog stays empty


Hello,

A few days ago i needed to look at the syslogs (Slack 10) and i found that /var/log/syslog is empty. The syslogd is running and all other logs are updated but not syslog.

I tried removing the /var/log/syslog* files and restart the syslogd but all that happens is a new /var/log/syslog is created but it stays empty.

Now, i could use some help here but i don't really now what info i need to give. Please advise.

thnx in advance.
 
Old 04-15-2005, 05:47 AM   #2
slackie1000
Senior Member
 
Registered: Dec 2003
Location: Brasil
Distribution: Arch
Posts: 1,037

Rep: Reputation: 45
hi there,

how your /etc/syslog.conf file looks like?

regards
slackie1000
 
Old 04-15-2005, 05:53 AM   #3
gbonvehi
Senior Member
 
Registered: Jun 2004
Location: Argentina (SR, LP)
Distribution: Slackware
Posts: 3,145

Rep: Reputation: 51
Do you have /etc/rc.d/rc.syslog as executable? Check if klogd is running which is the daemon that sends messages to syslogd about kernel stuff.
 
Old 04-15-2005, 07:02 AM   #4
Etraman
LQ Newbie
 
Registered: Dec 2004
Distribution: Slackware 10
Posts: 11

Original Poster
Rep: Reputation: 0
Quote:
Originally posted by slackie1000
hi there,

how your /etc/syslog.conf file looks like?
Here it is, looks ok to me:
Code:
# /etc/syslog.conf
# For info about the format of this file, see "man syslog.conf"
# and /usr/doc/sysklogd/README.linux.  Note the '-' prefixing some
# of these entries;  this omits syncing the file after every logging.
# In the event of a crash, some log information might be lost, so
# if this is a concern to you then you might want to remove the '-'.
# Be advised this will cause a performation loss if you're using
# programs that do heavy logging.

# Uncomment this to see kernel messages on the console.
#kern.*							/dev/console

# Log anything 'info' or higher, but lower than 'warn'.
# Exclude authpriv, cron, mail, and news.  These are logged elsewhere.
*.info;*.!warn;\
	authpriv.none;cron.none;mail.none;news.none	-/var/log/messages

# Log anything 'warn' or higher.
# Exclude authpriv, cron, mail, and news.  These are logged elsewhere.
*.warn;\
	authpriv.none;cron.none;mail.none;news.none	-/var/log/syslog

# Debugging information is logged here.
*.=debug						-/var/log/debug

# Private authentication message logging:
authpriv.*						-/var/log/secure

# Cron related logs:
cron.*							-/var/log/cron

# Mail related logs:
mail.*							-/var/log/maillog

# Emergency level messages go to all users:
*.emerg							*

# This log is for news and uucp errors:
uucp,news.crit						-/var/log/spooler

# Uncomment these if you'd like INN to keep logs on everything.
# You won't need this if you don't run INN (the InterNetNews daemon).
#news.=crit					-/var/log/news/news.crit
#news.=err					-/var/log/news/news.err
#news.notice					-/var/log/news/news.notice
Quote:
Originally posted by gbonvehi
Do you have /etc/rc.d/rc.syslog as executable? Check if klogd is running which is the daemon that sends messages to syslogd about kernel stuff.
/etc/rc.d/rc.syslog is executable:
Code:
# ls -o rc.syslog
-rwxr-xr-x  1 root 860 2004-05-03 00:07 rc.syslog*
Both syslogd and klogd are running:
Code:
# ps -e|grep logd
25034 ?        00:00:00 syslogd
25049 ?        00:00:00 klogd
*thnx for the replies, much appreciated!
 
Old 04-15-2005, 07:17 AM   #5
slackie1000
Senior Member
 
Registered: Dec 2003
Location: Brasil
Distribution: Arch
Posts: 1,037

Rep: Reputation: 45
hi there,

sorry mate. this is weird. no idea what is going on.
the only thing that i would say is that you could try to restart the services:
klogd and syslogd.
if it does not work....

regards

slackie1000

Last edited by slackie1000; 04-15-2005 at 08:47 AM.
 
Old 04-15-2005, 11:08 AM   #6
Etraman
LQ Newbie
 
Registered: Dec 2004
Distribution: Slackware 10
Posts: 11

Original Poster
Rep: Reputation: 0
Both syslogd and klogd have been restarted but still no syslog...
 
Old 04-18-2005, 05:34 PM   #7
Etraman
LQ Newbie
 
Registered: Dec 2004
Distribution: Slackware 10
Posts: 11

Original Poster
Rep: Reputation: 0
I checked the system for rootkits with rootkithunter and it seems the system has not been compomised either..

I really haven't got any clue of why this is happening. Please, if any one reads this, consider it an S.O.S.

thnx.
 
Old 04-18-2005, 06:13 PM   #8
egag
Senior Member
 
Registered: Jul 2004
Location: Netherlands
Distribution: Slackware
Posts: 2,721

Rep: Reputation: 52
are those syslog & messages -files writeable and owned by root ?

egag
 
Old 04-18-2005, 07:15 PM   #9
Etraman
LQ Newbie
 
Registered: Dec 2004
Distribution: Slackware 10
Posts: 11

Original Poster
Rep: Reputation: 0
Quote:
Originally posted by egag
are those syslog & messages -files writeable and owned by root ?

egag
Seems so:

# ls -o /var/log/syslog
-rw-r--r-- 1 root 0 2005-04-17 04:40 /var/log/syslog

When i delete this file and restart syslogd it gets created again, but nothing is written to it.

My /var/log/cron and /var/log/spooler are empty too. All other log files seem OK.
 
Old 04-19-2005, 01:04 AM   #10
vdemuth
Member
 
Registered: Oct 2003
Location: West Midlands, UK
Distribution: Slackware 14 (Server),Suse 13.1 (Desktop),, Mepis on the wifes lappy
Posts: 768

Rep: Reputation: 92
You might want to look at your logrotate function. Make sure it's not set to something strange like rotate upon maximum size, or on bootup or shutdown etc.
Other than that, really no other ideas.
I suppose you could install webmin and use that to set up your logging facilities
 
Old 04-19-2005, 03:48 PM   #11
Etraman
LQ Newbie
 
Registered: Dec 2004
Distribution: Slackware 10
Posts: 11

Original Poster
Rep: Reputation: 0
Quote:
Originally posted by vdemuth
You might want to look at your logrotate function. Make sure it's not set to something strange like rotate upon maximum size, or on bootup or shutdown etc.
Other than that, really no other ideas.
I suppose you could install webmin and use that to set up your logging facilities
Logratation seems to be fine too, setup to rotate once a week, which actually happens too. All logs are rotated every week.

Now, some other issues with the server made us decide to upgrade the kernel to 2.6.11.7 today. We booted the server with the new kernel and now syslogging works as it should. On one hand OK, on the other a bit of a pity because now i still don't know what was the cause of this problem.
But there are a few problems that came up using the new kernel so we just might go back to the 2.4.26 kernel if we can't solve those new problems. When that's the case i guess i'll post back in this thread. Otherwise esac.

I do, however, stay curious to actually know what the cause of this problem is/was.


Thnx to everybody for the input ! Much appreciated!
 
Old 04-20-2005, 12:33 AM   #12
eelriver
Member
 
Registered: May 2004
Location: san francisco
Distribution: Slackware 10.2 kernel 2.6.13, Gentoo amd64, Some mish-mash of programs that started with slack 9.0
Posts: 165

Rep: Reputation: 30
I had this problem when I inadvertently compiled in debugging on something and one of the files in /var/log got to 2G in size. If any file written by the syslog gets that big, no more logging.
 
Old 04-20-2005, 07:45 PM   #13
Etraman
LQ Newbie
 
Registered: Dec 2004
Distribution: Slackware 10
Posts: 11

Original Poster
Rep: Reputation: 0
Quote:
Originally posted by eelriver
I had this problem when I inadvertently compiled in debugging on something and one of the files in /var/log got to 2G in size. If any file written by the syslog gets that big, no more logging.
Yes, i've read that somewhere too. But the logs on the server are nowhere near that size, i'm afraid.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Gentoo VNC, empty dialog box !! "Question" window is empty ! TheHushedCaskeT Linux - Software 0 02-01-2005 10:14 PM
My HD stays flickering, before not. GnaM Linux - Newbie 2 01-07-2005 09:16 AM
X stays blank ctim Slackware 7 06-27-2004 12:34 PM
Upgrading from 9.2 to 10.0 (What stays what goes what comes again) barbarochi Mandriva 3 04-06-2004 05:12 PM
HD light stays on jMack Linux - Newbie 2 12-18-2002 08:44 AM


All times are GMT -5. The time now is 10:56 AM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration