Can not view detail of /var/log/messages

gardenair · 04-18-2011, 06:49 AM

Hi,
I want to check my system general log file by

Code:

root@office-proxy ~]#tail -f /var/log/messages
Apr 18 10:14:33 office-proxy syslogd 1.4.1: restart.
Apr 18 10:56:18 office-proxy ntpd[4941]: synchronized to 109.72.80.61, stratum 2
Apr 18 12:09:32 office-proxy ntpd[4941]: synchronized to 85.91.1.180, stratum 2

It is not showing me detail.

Kindly guide me what should be the problem ?

thanks in advance,
garden

repo · 04-18-2011, 06:52 AM

Quote:

It is not showing me detail

What details are you looking for?

Kind regards

gardenair · 04-18-2011, 07:02 AM

thanks for the reply. Actually every day the system shutdown at 7:00 pm using crontab -e. I normally every day check the system log file and it show me a list of lines and i view every the complete messages.
I want to view the details that it was shutdown properly. It just show me

Code:

[root@office-proxy ~]#tail -f /var/log/messages
Apr 18 10:14:33 office-proxy syslogd 1.4.1: restart.
Apr 18 10:56:18 office-proxy ntpd[4941]: synchronized to 109.72.80.61, stratum 2
Apr 18 12:09:32 office-proxy ntpd[4941]: synchronized to 85.91.1.180, stratum 2
[root@office-proxy ~]#

I does not know what my Linux box is saying me

thanks
garden

repo · 04-18-2011, 07:29 AM

Tail -f will only give you the last entry's from the logfiles.
You could use

Code:

tail -50 /var/log/messages

to view the latest 50 entry's
Or use

Code:

cat /var/log/messages | grep <whatever-you-are-looking-for>

Kind regards

gardenair · 04-18-2011, 07:54 AM

thanks "repo" for the reply. Well i have already did the practice that you have mentioned but still it show me only these two lines

Code:

[root@office-proxy ~]#tail -f /var/log/messages
Apr 18 10:14:33 office-proxy syslogd 1.4.1: restart.
Apr 18 10:56:18 office-proxy ntpd[4941]: synchronized to 109.72.80.61, stratum 2
Apr 18 12:09:32 office-proxy ntpd[4941]: synchronized to 85.91.1.180, stratum 2
[root@office-proxy ~]#

Waiting for your valuable suggestions.

Kinds Regards
garden

repo · 04-18-2011, 11:29 AM

Quote:

[root@office-proxy ~]#tail -f /var/log/messages

So there are no entry's after

Code:

Apr 18 12:09:32 office-proxy ntpd[4941]: synchronized to 85.91.1.180, stratum 2

Try

Code:

cat var/log/messages

Which distribution are you using?
If you use SELinux, see if it's enabled and if some rule prevents syslogd from writing.
You could disable SELinux to see.

Kind regards

gardenair · 04-19-2011, 12:21 AM

well i am using Cent os 5 . I have also use the
cat /var/log/messages but i see the same result.

I use my another linux machine. and apply the same command

Code:

[root@localhost root]# tail -f /var/log/messages
Apr 19 08:04:38 localhost gdm[2399]: gdm_server_spawn: Could not open logfile for display :0!
Apr 19 08:06:19 localhost gdm(pam_unix)[2398]: session opened for user root by (uid=0)
Apr 19 08:06:20 localhost gconfd (root-2477): starting (version 2.2.0), pid 2477 user 'root'
Apr 19 08:06:20 localhost gconfd (root-2477): Resolved address "xml:readonly:/etc/gconf/gconf.xml.mandatory" to a read-only config source at position 0
Apr 19 08:06:20 localhost gconfd (root-2477): Resolved address "xml:readwrite:/root/.gconf" to a writable config source at position 1
Apr 19 08:06:20 localhost gconfd (root-2477): Resolved address "xml:readonly:/etc/gconf/gconf.xml.defaults" to a read-only config source at position 2
Apr 19 08:06:23 localhost kernel: ide-floppy driver 0.99.newide
Apr 19 08:06:23 localhost kernel: hdc: ATAPI 48X DVD-ROM DVD-R-RAM CD-R/RW drive, 2048kB Cache, UDMA(33)
Apr 19 08:06:23 localhost kernel: Uniform CD-ROM driver Revision: 3.12
Apr 19 08:06:24 localhost kernel: cdrom: This disc doesn't have any tracks I recognize!

My SELinx is already disable but I does not know why it is showing me this

Code:

root@office-proxy ~]#tail -f /var/log/messages
Apr 18 10:14:33 office-proxy syslogd 1.4.1: restart.
Apr 18 10:56:18 office-proxy ntpd[4941]: synchronized to 109.72.80.61, stratum 2
Apr 18 12:09:32 office-proxy ntpd[4941]: synchronized to 85.91.1.180, stratum 2
[root@office-proxy ~]#

Thanks for the reply,
garden

chrism01 · 04-19-2011, 01:42 AM

What about the older logfiles messages.1, messages.2 etc ?
Possibly logrotate starts a new file upon reboot ?

gardenair · 04-19-2011, 05:16 AM

Not understand

Code:

What about the older logfiles messages.1, messages.2 etc ?
Possibly logrotate starts a new file upon reboot ?

repo · 04-19-2011, 05:23 AM

Do you have write access to the logfiles?
Take a look in

Code:

/etc/syslog.conf

for any anomalies

Kind regards

gardenair · 04-19-2011, 07:51 AM

thanks for the reply well it show my the output as

Code:

[root@office-proxy ~]# ls -l /etc/syslog.conf
-rw-r--r-- 1 root root 938 Mar  3 05:53 /etc/syslog.conf
[root@office-proxy ~]#

thanks for guidance,
garden

repo · 04-19-2011, 07:53 AM

You need to verify the /var/log directory

Code:

ls -l /var/log

And look inside the file

Code:

/etc/syslog.conf

for anomalies

Kind regards

gardenair · 04-20-2011, 12:10 AM

thanks again for the help.

Code:

[root@office-proxy ~]# ls -l /var/log | more
total 2624
-rw-r----- 1 root  root   13849 Apr 20 08:55 acpid
-rw------- 1 root  root  491321 Mar  3 06:08 anaconda.log
-rw------- 1 root  root   31092 Mar  3 06:08 anaconda.syslog
-rw------- 1 root  root   38976 Mar  3 06:08 anaconda.xlog
drwxr-x--- 2 root  root    4096 Mar  3 06:42 audit
-rw------- 1 root  root       0 Apr 18 10:14 boot.log
-rw------- 1 root  root       0 Apr 11 09:59 boot.log.1
-rw------- 1 root  root       0 Apr  4 09:59 boot.log.2
-rw------- 1 root  root       0 Mar 28 10:13 boot.log.3
-rw------- 1 root  root       0 Mar 21 10:07 boot.log.4
-rw------- 1 root  utmp    4224 Apr 19 10:21 btmp
drwxr-xr-x 2 root  root    4096 Nov 11  2007 conman
drwxr-xr-x 2 root  root    4096 Nov 11  2007 conman.old
-rw------- 1 root  root    3629 Apr 20 09:01 cron
-rw------- 1 root  root    6921 Apr 18 10:14 cron.1
-rw------- 1 root  root    7341 Apr 11 09:58 cron.2
-rw------- 1 root  root    7001 Apr  4 09:58 cron.3
-rw------- 1 root  root    5487 Mar 28 10:12 cron.4
drwxr-xr-x 2 lp    sys     4096 Apr 18 10:14 cups
-rw-r--r-- 1 root  root   20963 Apr 20 08:54 dmesg
-rw------- 1 root  root    2352 Mar  3 06:07 faillog
drwxr-xr-x 2 root  root    4096 Apr 20 08:55 gdm
drwx------ 2 root  root    4096 Jan 16  2008 httpd
-rw-r--r-- 1 root  root   28616 Apr 20 09:03 lastlog
drwxr-xr-x 2 root  root    4096 Mar  3 05:50 mail
-rw------- 1 root  root    2275 Apr 20 08:54 maillog
-rw------- 1 root  root    9530 Apr 18 10:14 maillog.1
-rw------- 1 root  root    9899 Apr 11 09:58 maillog.2
-rw------- 1 root  root    9530 Apr  4 09:59 maillog.3
-rw------- 1 root  root    7624 Mar 28 10:12 maillog.4
-rw------- 1 root  root   74940 Apr 20 08:59 messages
-rw------- 1 root  root  184844 Apr 18 10:10 messages.1
--More--

and the /etc/syslog.conf is showing as

Code:

# cat /etc/syslog.conf is showing as


[root@office-proxy ~]# cat /etc/syslog.conf
# Log all kernel messages to the console.
# Logging much else clutters up the screen.
#kern.*                                                 /dev/console

# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;mail.none;news.none;authpriv.none;cron.none              /var/log/messages

# The authpriv file has restricted access.
authpriv.*                                              /var/log/secure

# Log all the mail messages in one place.
mail.*                                                  -/var/log/maillog


# Log cron stuff
cron.*                                                  /var/log/cron

# Everybody gets emergency messages
*.emerg                                                 *

# Save news errors of level crit and higher in a special file.
uucp,news.crit                                          /var/log/spooler

# Save boot messages also to boot.log
local7.*                                                /var/log/boot.log

#
# INN
#
news.=crit                                        /var/log/news/news.crit
news.=err                                         /var/log/news/news.err
news.notice                                       /var/log/news/news.notice
[root@office-proxy ~]#

thanks again for the guidance,
garden

repo · 04-20-2011, 04:53 AM

Quote:

-rw------- 1 root root 74940 Apr 20 08:59 messages

The system has written to the log at

Code:

Apr 20 08:59

Do you see these entry's?
I have this line in /etc/syslog

Code:

*.info;*.!warn;authpriv.none;cron.none;mail.none;news.none	-/var/log/messages

Kind regards