Syslogd crashing/won't run after webmin bandwidth monitoring...

Voltar · 04-29-2006, 05:28 AM

I seem to have a problem with syslogd. Ever since I've installed webmin and enabled the bandwidth monitoring (iptables rule), syslogd seems to randomly crash after a while, and doesn't seem to run/load at boot. It will also mysteriously shut down in less than five minutes if I start it manually. All the insmod errors and everything from rc.hotplug used to show up in the /var/log/syslog file but now they fly across the screen and nothing from the boot up process is logged.

I also seem to have this 2 GiB "debug" file in /var/log/ now that I've never really noticed before. If I tail the last few lines of the file, it seems to be iptables bandwidth logging, but that doesn't make sense as the bandwidth stuff was supposed to be stored in /var/log/bandwidth and I've verified that it is logged there while everything was working. Also the entries in debug stop the last time syslogd was known to work/run.

I've narrowed it down to the webmin bandwidth monitoring because I've reinstalled and slowly added stuff to see when it broke. The only thing is, I really don't want to go throug another reinstall, so is there anyway to fix syslogd?

Also, is there any other good (free) bandwidth monitoring/logging tools/programs? I just need to monitor bandwidth on the external interface of this box, and it's only a dhcp server, firewall, router and samba server so if the program was inefficient and sucked up cpu cycles it wouldn't matter to me.

Thanks in advance, and let me know if anything doesn't make sense...

-David

Alien Bob · 04-29-2006, 07:54 AM

If you want simple bandwidth monitoring, then MTRG is more than adequate. It does not need any iptables rules, and reads its information from the interface statistics.
MTRG produces nice graphs.

Eric

Voltar · 04-29-2006, 02:42 PM

Thanks, I'm looking at MTRG and NTOP right now too see which will be better.

Just one thing, is there anyway to get syslogd to work again? I woke up this morning and looked at the console and it had spit out a bunch of messages (dhcpcd, etc that would normally be logged) on the console even though no one was logged in...

At the very least I've rebooted the machine, everything works fine except syslogd. Is it really that necessary to have it running?

Alien Bob · 04-29-2006, 03:32 PM

You can edit /etc/syslog.conf and take out the changes.

In essence (stripped of empty lines and comments) this is what should be there in a "virginal" file:

Code:

*.info;*.!warn;\
        authpriv.none;cron.none;mail.none;news.none     -/var/log/messages
*.warn;\
        authpriv.none;cron.none;mail.none;news.none     -/var/log/syslog
*.=debug                                                -/var/log/debug
authpriv.*                                              -/var/log/secure
cron.*                                                  -/var/log/cron
mail.*                                                  -/var/log/maillog
*.emerg                                                 *
uucp,news.crit                                          -/var/log/spooler

If yours is different anywhere, revert the changes and then restart syslog, by running

Code:

/etc/rc.d/rc.syslog restart

Eric

Voltar · 05-01-2006, 03:20 AM

Thanks a million! That got it working again, there were some other "kern.debug" stuff in there.

Also I did a little testing, it seems that when the /var/log/debug file gets to 2GB, syslogd wont run and/or crashes like I mentioned before. Is this a bug of some type or a default behavior? Would it be bad to just stop the debug log from being written in the first place in syslog.conf? Right now I just have a cron job deleting the file every four hours.

Thanks again.