LinuxQuestions.org
Visit Jeremy's Blog.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Distributions > Mandriva
User Name
Password
Mandriva This Forum is for the discussion of Mandriva (Mandrake) Linux.

Notices


Reply
  Search this Thread
Old 02-23-2009, 01:10 PM   #1
duderancher
LQ Newbie
 
Registered: Oct 2005
Posts: 19

Rep: Reputation: 0
cannot rm messages operation not permitted


I have a /var/log/messages and /var/log/syslog file that have grow to an unmanageable size (800MB). I am unable to rm, mv, or truncate these log files and receive the error "operation not permitted". I am root and I have shutoff syslogd at start up. What could possibly be preventing root from administering these logs?

I even configured my syslog.conf to write "messages" and "syslog" to temp files instead of the default /var/log/messages and /var/log/syslog respectively and this had no effect. Since then, syslog is turned off.

Any help would be greatly appreciated.
 
Old 02-23-2009, 03:20 PM   #2
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,409
Blog Entries: 55

Rep: Reputation: 3582Reputation: 3582Reputation: 3582Reputation: 3582Reputation: 3582Reputation: 3582Reputation: 3582Reputation: 3582Reputation: 3582Reputation: 3582Reputation: 3582
Shut down syslogd and klogd, then run 'F="/var/log/messages"; ls -alZ $F; stat $f; lsattr $F; fuser $F' to show what still has the file open and if any (extended) attributes are in use? And why 'rm' instead of the default practice of logrotating things?
 
Old 02-23-2009, 04:21 PM   #3
duderancher
LQ Newbie
 
Registered: Oct 2005
Posts: 19

Original Poster
Rep: Reputation: 0
solved...thank you

You hit the nail on the head. The lsattr showed that the -a attribute was set which allows only for the appending of the file. I changed this ( chattr +a <filename> ) and I was able to truncate the log.

I will manage the logs going forward with logrotate. I just inherited this particular server at work and it's logs were not properly managed. I have a proftpd process that writes to the log quite a bit and this would account for its massive size. I will look to also find a way to remedy the proftpd output separately. Thank you for your help. Much appreciated!
 
Old 02-23-2009, 04:47 PM   #4
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,409
Blog Entries: 55

Rep: Reputation: 3582Reputation: 3582Reputation: 3582Reputation: 3582Reputation: 3582Reputation: 3582Reputation: 3582Reputation: 3582Reputation: 3582Reputation: 3582Reputation: 3582
Quote:
Originally Posted by duderancher View Post
I changed this ( chattr +a <filename> ) and I was able to truncate the log.
Note that if you would like to retain the extended attribute, logrotate pre/postscripts can un/set it, offering only a small window of opportunity for (whatever) activity.


Quote:
Originally Posted by duderancher View Post
I will look to also find a way to remedy the proftpd output separately.
Maybe revisit http://www.castaglia.net/proftpd/doc...O-Logging.html for changing the daemon facility to one of syslog.conf's local.* slots and a custom logfile name or the FIFO method?
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Operation not permitted prasunhowlader Linux - Newbie 3 08-20-2008 09:29 PM
Operation not permitted jakkals Linux - General 3 09-26-2005 07:30 PM
su - operation not permitted jrtayloriv Linux - Newbie 2 06-09-2005 09:27 PM
operation not permitted jamaso Slackware 2 05-08-2004 05:55 AM
Operation not permitted FrozenShadow23 Linux - Newbie 6 10-05-2003 05:13 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Distributions > Mandriva

All times are GMT -5. The time now is 04:04 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration