/var/log/syslog is empty? Is this normal?

Altiris · 10-02-2015, 09:21 AM

These are my syslog files,

Code:

-rw-r----- 1 root   root      3085 Sep  5 20:37 syslog.4
-rw-r----- 1 root   root     20838 Sep 13 13:58 syslog.3
-rw-r----- 1 root   root       339 Sep 20 01:23 syslog.2
-rw-r----- 1 root   root      2790 Sep 25 22:59 syslog.1
-rw-r----- 1 root   root         0 Sep 28 04:40 syslog

syslog file is empty, syslog.1 has a log up to Sep 25. syslog.2 has up to Sep 20. syslog.3 has up to Sep 13. This is unrealted but other issues I am noticed is an error with NFSD saying "unable to create client record with stable storage: -110" and my cron entries for rsnapshot are not running, but that is unrelated.. Now if anyone has read my previous posts, the HDD Slackware is on has bad sectors, I haven't had time to purchase a new HDD...well not so much purchasing but copying Slackware onto a new HDD because of school. So I am not sure if it is normal for syslog to be empty or if its an issue related with a bad sector on my drive.

rtmistler · 10-02-2015, 09:48 AM

Possibly related to the fact that you have known bad sectors. How much space is left on this drive?

Altiris · 10-02-2015, 11:18 AM

Quote:

Originally Posted by rtmistler

Possibly related to the fact that you have known bad sectors. How much space is left on this drive?

A lot of space, ran df -h and I have over 400GB of free space.

rtmistler · 10-02-2015, 11:32 AM

And just slapping myself upside the head here....

syslog won't get anything if nothing changes on your system of any significance.

I.e. if you don't plug in or remove a USB drive, or raise/lower a network interface. Then basically you won't see any newly added syslog entries.

I will grant that it's over a week old since the last rotation; however on my dev system I really won't see any syslog entries because I don't allow it to hibernate, sleep, or other. And I don't generally plug in or remove drives unless that happens to be related to something I'm working on. So, if there are no relevant logs, it's perfectly fine that there are no syslog entries. What shows last in the last rotated log, syslog.1? Seems obvious to me that you're rotating in forced mode such that it will rotate no matter what the size.

And then plug in a USB stick and remove it and see if you get new syslog entries. Or lower and re-raise a network connection. Same thought process there.

szboardstretcher · 10-02-2015, 12:07 PM

For testing syslog you can use 'logger'

Quote:

LOGGER(1) User Commands
NAME
logger - a shell command interface to the syslog(3) system log module

For example:

Code:

logger IM A TEST
tail /var/log/syslog

WiseDraco · 10-02-2015, 12:22 PM

Quote:

Originally Posted by rtmistler

And just slapping myself upside the head here....

syslog won't get anything if nothing changes on your system of any significance.

really?
i remember, some time ago there is a "MARK" entry each ten minutes in syslog, even if no any changes.
thanks to that "mark" records can be determined, about in what clock machine is lock-up, for example....

Diantre · 10-02-2015, 01:04 PM

Quote:

Originally Posted by Altiris

So I am not sure if it is normal for syslog to be empty or if its an issue related with a bad sector on my drive.

I've only seen my syslog at 0 bytes right after the log rotation. It can remain like that for a while, until a log message is written to it.

Quote:

Originally Posted by WiseDraco

... there is a "MARK" entry each ten minutes in syslog, even if no any changes.

I think the "-- MARK --" line appears only in /var/log/messages, every 20 minutes if there's no other activity.

genss · 10-02-2015, 01:40 PM

from /etc/syslog.conf

Code:

# Log anything 'warn' or higher.
# Exclude authpriv, cron, mail, and news.  These are logged elsewhere.
*.warn;\
	authpriv.none;cron.none;mail.none;news.none	-/var/log/syslog

ponce · 10-02-2015, 02:15 PM

Quote:

Originally Posted by Diantre

I think the "-- MARK --" line appears only in /var/log/messages, every 20 minutes if there's no other activity.

it's controlled by the -m option of syslogd (see the man page): you can change it passing that option with desired interval when launching it from /etc/rc.d/rc.syslog (line 10).
if, for example, you change line 10 of the above file from

Code:

    /usr/sbin/syslogd

to

Code:

    /usr/sbin/syslogd -m 0

you disable the MARK timestamp.

rtmistler · 10-02-2015, 02:19 PM

Quote:

Originally Posted by szboardstretcher

For testing syslog you can use 'logger'
...

Either case just follow szboardstretcher's recommendation, test that you do or don't get new records in your syslog and then update whether or not this was merely log rotation and nothing further which caused the zero sized syslog file.

Altiris · 10-02-2015, 03:35 PM

I have a feeling the system borked itself once more (this is the bad sector errors fault, last time this happened I had to run fsck and hit yes a bunch of times to restore stuff). I am afraid of rebooting it but I probably will have to and that problem will probably occur again.

So anyway, I tried

Code:

logger IM A TEST
tail /var/log/syslog

And syslog is still empty...I am going to do a reboot and see if it fails rebooting as normally that happens when there are more bad sector errors.

Diantre · 10-02-2015, 05:06 PM

Quote:

Originally Posted by Altiris

So anyway, I tried

Code:

logger IM A TEST
tail /var/log/syslog

And syslog is still empty...

That's because the default priority is "user.notice", so it goes to /var/log/messages. It has to be at least a warning level to be logged in the syslog (with the default configuration of course).

Try this:

Code:

logger -p user.warning HELLO

Altiris · 10-02-2015, 09:44 PM

Quote:

Originally Posted by Diantre

That's because the default priority is "user.notice", so it goes to /var/log/messages. It has to be at least a warning level to be logged in the syslog (with the default configuration of course).

Try this:

Code:

logger -p user.warning HELLO

I rebooted the machine, surpsingly no errors were found and things were written back into syslog file.
Doing that command logger -p user.warning HELLO also worked so I think it is fine.