LinuxQuestions.org
Share your knowledge at the LQ Wiki.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices


Reply
  Search this Thread
Old 05-22-2020, 05:10 AM   #1
indolynx
LQ Newbie
 
Registered: May 2020
Posts: 5

Rep: Reputation: Disabled
Deleted /var/log folder. Need help with messages and boot.log


Hi All,

I'm having some issues with the messages and boot.log (for syslogs)

I deleted the /var/log folder by mistake on my machine and lost all the files.
Post this, I rebooted the machine and some of the files have returned.

Code:
[root@localhost ~]# ls -ltr /var/log
total 192
-rw-------. 1 root   root        0 May 21 16:59 messages
-rw-------. 1 root   root        0 May 21 16:59 secure
-rw-------. 1 root   root        0 May 21 16:59 maillog
-rw-------. 1 root   root        0 May 21 16:59 spooler
-rw-------. 1 root   root      218 May 21 17:02 yum.log
-rw-------. 1 root   utmp        0 May 21 17:06 btmp
-rw-r--r--. 1 root   root   110668 May 21 17:06 dmesg
-rw-r--r--. 1 root   root     1323 May 21 17:06 vmware-vgauthsvc.log.0
drwxr-xr-x. 2 chrony chrony      6 May 21 17:06 chrony
-rw-r--r--. 1 root   root     1006 May 21 17:06 vmware-vmsvc.log
-rw-r--r--. 1 root   root      614 May 21 17:06 firewalld
drwx------. 2 root   lp         57 May 21 17:06 cups
drwxr-xr-x. 2 root   root       23 May 21 17:06 tuned
-rw-------. 1 root   root    13760 May 21 17:07 boot.log
drwx--x--x. 2 root   gdm        42 May 21 17:07 gdm
-rw-r--r--. 1 root   root       40 May 21 17:07 wpa_supplicant.log
-rw-r--r--. 1 root   root    26060 May 21 17:07 Xorg.0.log
-rw-------. 1 root   root     1550 May 21 19:01 cron
-rw-rw-r--. 1 root   utmp     1920 May 21 19:46 wtmp
-rw-r--r--. 1 root   root   292876 May 21 19:46 lastlog
However, the boot.log file is not logging anything new. I have restarted the rsyslog service multiple times. I've also uninstalled rsyslog and re-installed it.

I've got the rsyslog logging debug messages to boot.log

Code:
# Save boot messages also to boot.log
local7.*                                                /var/log/boot.log
I have a device sending debug level logs to this machine, but they are not getting logged. When I do the following, it shows rsyslog is running, but the output does not get appended to the boot.log file.

Code:
[root@localhost ~]# logger -s "Hello world"
root: Hello world
[root@localhost ~]# tail /var/log/boot.log
         Starting GNOME Display Manager...
[  OK  ] Started Job spooling tools.
         Starting Job spooling tools...
[  OK  ] Started Notify NFS peers of a restart.
[  OK  ] Started OpenSSH server daemon.
[  OK  ] Started System Logging Service.
[  OK  ] Started GNOME Display Manager.
[  OK  ] Started Dynamic System Tuning Daemon.
[  OK  ] Started Postfix Mail Transport Agent.
[  OK  ] Started Virtualization daemon.
Please help me in understanding why the boot.log isn't updating.
 
Old 05-22-2020, 10:04 PM   #2
scasey
Senior Member
 
Registered: Feb 2013
Location: Tucson, AZ, USA
Distribution: CentOS 7.7.1908
Posts: 4,760

Rep: Reputation: 1726Reputation: 1726Reputation: 1726Reputation: 1726Reputation: 1726Reputation: 1726Reputation: 1726Reputation: 1726Reputation: 1726Reputation: 1726Reputation: 1726
Not in front of a Linux box at the moment, but my recollection is that boot.log only shows the details (POST?) of the last boot. There’s nothing to update between boots.

To check:
  1. Make a copy of the boot.log
  2. Reboot the ‘puter
  3. Compare the new boot.log o the copy
 
1 members found this post helpful.
Old 05-22-2020, 10:46 PM   #3
michaelk
Moderator
 
Registered: Aug 2002
Posts: 19,925

Rep: Reputation: 3303Reputation: 3303Reputation: 3303Reputation: 3303Reputation: 3303Reputation: 3303Reputation: 3303Reputation: 3303Reputation: 3303Reputation: 3303Reputation: 3303
It looks like you are running a Red Hat or derivative distribution. syslog messages are written to /var/log/messages or /var/log/secure.

Check the contents of /var/log/messages for your "Hello World" test.
grep "Hello World" /var/log/messages

Since logs rotate it might be in a /var/log/messages-2020MMDD file.
 
1 members found this post helpful.
Old 05-23-2020, 02:19 AM   #4
indolynx
LQ Newbie
 
Registered: May 2020
Posts: 5

Original Poster
Rep: Reputation: Disabled
Quote:
Originally Posted by scasey View Post
Not in front of a Linux box at the moment, but my recollection is that boot.log only shows the details (POST?) of the last boot. There’s nothing to update between boots.

To check:
  1. Make a copy of the boot.log
  2. Reboot the ‘puter
  3. Compare the new boot.log o the copy
The new boot.log contains only the list of processes being started up. No new messages get logged to this file.
 
Old 05-23-2020, 02:21 AM   #5
indolynx
LQ Newbie
 
Registered: May 2020
Posts: 5

Original Poster
Rep: Reputation: Disabled
Quote:
Originally Posted by michaelk View Post
It looks like you are running a Red Hat or derivative distribution. syslog messages are written to /var/log/messages or /var/log/secure.

Check the contents of /var/log/messages for your "Hello World" test.
grep "Hello World" /var/log/messages

Since logs rotate it might be in a /var/log/messages-2020MMDD file.
The messages file has been at 0 bytes since the folder was recreated. None of the logger messages are getting logged to the messages.
 
Old 05-23-2020, 10:47 AM   #6
michaelk
Moderator
 
Registered: Aug 2002
Posts: 19,925

Rep: Reputation: 3303Reputation: 3303Reputation: 3303Reputation: 3303Reputation: 3303Reputation: 3303Reputation: 3303Reputation: 3303Reputation: 3303Reputation: 3303Reputation: 3303
What distribution version are you actually running?

Did you verify the /etc/rsyslog.conf file line for writing to messages is uncommented?
Code:
# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;mail.none;authpriv.none;cron.none                /var/log/messages
 
Old 05-23-2020, 04:17 PM   #7
scasey
Senior Member
 
Registered: Feb 2013
Location: Tucson, AZ, USA
Distribution: CentOS 7.7.1908
Posts: 4,760

Rep: Reputation: 1726Reputation: 1726Reputation: 1726Reputation: 1726Reputation: 1726Reputation: 1726Reputation: 1726Reputation: 1726Reputation: 1726Reputation: 1726Reputation: 1726
Quote:
Originally Posted by indolynx View Post
The new boot.log contains only the list of processes being started up. No new messages get logged to this file.
Yes, that's how boot.log works. It only gets written to at boot time.
 
Old 05-24-2020, 12:11 AM   #8
indolynx
LQ Newbie
 
Registered: May 2020
Posts: 5

Original Poster
Rep: Reputation: Disabled
Quote:
Originally Posted by michaelk View Post
What distribution version are you actually running?

Did you verify the /etc/rsyslog.conf file line for writing to messages is uncommented?
Code:
# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;mail.none;authpriv.none;cron.none                /var/log/messages
I'm running CentOS 7. (centos-release-7-4.1708.el7.centos.x86_64)
Yes this line is uncommented. I have attached the rsyslog.conf for your reference.


Quote:
Originally Posted by scasey
Yes, that's how boot.log works. It only gets written to at boot time.
The rsyslog.conf file points all local7.* messages to be written to boot.log and prior to my mistake, debugs were getting logged to this file as expected.
Attached Files
File Type: txt rsyslog.conf.txt (3.6 KB, 1 views)

Last edited by indolynx; 05-25-2020 at 02:00 AM.
 
Old 05-25-2020, 07:25 AM   #9
indolynx
LQ Newbie
 
Registered: May 2020
Posts: 5

Original Poster
Rep: Reputation: Disabled
I re-installed the machine, re-installed rsyslog and boot.log is logging the local7.* messages coming from external sources.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
[SOLVED] iptables troubleshooting icmp and best place to log /var/log/messages or /var/log/iptables JockVSJock Linux - Security 18 02-12-2016 12:31 AM
where are /var/log/dmesg and /var/log/messages sryzdn Linux - Newbie 4 02-09-2015 09:35 PM
/var/adm/messages vs /var/log/messages gomes1333 Linux - General 1 04-06-2010 04:08 AM
/var/log/messages and /var/log/cron not working sigkill Linux - Software 6 08-09-2008 01:08 PM
Deleted /var/log/messages, can't log any files-iptables chingyenccy Linux - Newbie 7 02-27-2005 04:03 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie

All times are GMT -5. The time now is 11:55 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration