/var/adm/messages stops, dissapears.

From: Bruntel, Mitchell L, ALABS (mbruntel_at_att.com)
Date: 09/18/03

  • Next message: Bruntel, Mitchell L, ALABS: "Partial Summary: /var/adm/messages stops, dissapears."
    Date: Thu, 18 Sep 2003 09:24:04 -0500
    To: <sunmanagers@sunmanagers.org>
    
    

    interesting problem with my syslog. (frustrating I mean)
    On one system I have the /var/adm/messages file keeps disapearing
    My log shows:
    Unusual System Events
    =-=-=-=-=-=-=-=-=-=-=
    File /var/adm/syslog cannot be read.
    File /var/adm/messages cannot be read.

    and I can do a restart (stop/restart) of syslog by doing a /etc/init.d/syslog
    stop, then a start

    and it is seen (since this problem started I added the following lines to the
    stock file:
    (based on original creation above)
                     if [ ! -f /var/adm/messages ]; then
                            /usr/bin/cp /dev/null /var/adm/messages
                            /usr/bin/chmod 0644 /var/adm/messages
                    fi
                    if [ ! -f /var/adm/syslog ]; then
                            /usr/bin/cp /dev/null /var/adm/syslog
                            /usr/bin/chmod 0644 /var/adm/syslog
                    fi
                    if [ ! -f /var/adm/maillog ]; then
                            /usr/bin/cp /dev/null /var/adm/maillog
                            /usr/bin/chmod 0644 /var/adm/maillog

    so it seems to restart ok, if only for another 10 mins or so.

    I've tried running a log of when it's stopping, lasts about 10-12 mins, then
    needs restart.
    process list when it stops doesnt show any immediate candidates for cause of
    problem.

    I'm kind of stumped?
    ideas, suggestions, welcome.

    I've included my /etc/syslog.conf to see if someone ELSE see's something funky
    that might be doing this, but I've
    been over it 5-6 times, and dont see much.

    Thanks again, and I did try a few searches on the list, but didnt come up with
    anything

    Oh yes, the syslogd daemon doesnt stop running, it's just that /var/messages
    disapears!

    Mitch Bruntel
    AT&T Labs

    ++++++++++++++++++++++++++++++++
    /etc/syslog.conf follows:
    #ident "@(#)syslog.conf 1.5 99/02/03 SMI" /* SunOS 5.0 */
    #
    # Copyright (c) 1991-1999 by Sun Microsystems, Inc.
    # All rights reserved.
    #
    # syslog configuration file.
    #
    # This file is processed by m4 so be careful to quote (`') names
    # that match m4 reserved words. Also, within ifdef's, arguments
    # containing commas must be quoted.
    #
    # next is original
    #*.info /var/adm/messages
    *.info;mail.info /var/adm/messages
    #mail.info /var/adm/maillog
    *.err;kern.notice /dev/sysmsg
    *.err;kern.debug;daemon.notice;mail.crit /var/adm/messages
    #kern, mark.debug /var/adm/messages
    # prev line for kernel mark

    *.alert;kern.err;daemon.err operator
    *.alert
    *.emerg *

    # if a non-loghost machine chooses to have authentication messages
    # sent to the loghost machine, un-comment out the following line:
    #auth.notice ifdef(`LOGHOST', /var/log/authlog, @loghost)

    #mail.debug ifdef(`LOGHOST', /var/log/syslog, @loghost)

    #
    # non-loghost machines will use the following lines to cause "user"
    # log messages to be logged locally.
    #
    ifdef(`LOGHOST', ,
    user.err /dev/sysmsg
    user.err /var/adm/messages
    user.alert `root, operator'
    user.emerg *
    )
    auth.debug /var/log/authlog
    auth.notice /var/log/authlog
    auth.info /var/log/authlog
    _______________________________________________
    sunmanagers mailing list
    sunmanagers@sunmanagers.org
    http://www.sunmanagers.org/mailman/listinfo/sunmanagers


  • Next message: Bruntel, Mitchell L, ALABS: "Partial Summary: /var/adm/messages stops, dissapears."

    Relevant Pages

    • Whats wrong with this in /etc/syslog.conf ?
      ... I am have written a C program to dump my file systems onto tape from my Ultra 80 running Solaris 10 update 1. ... The program writes some diagnostic information, such as barcodes via syslog. ... local1 is a valid facility, and debug is a valid severity as defined in RFC 3164 - The BSD Syslog Protocol. ... # if a non-loghost machine chooses to have authentication messages ...
      (comp.unix.solaris)
    • Re: sendmail log file
      ... # if a non-loghost machine chooses to have authentication messages ... # log messages to be logged locally. ... I can see at least 3 places where mail.* selectors exist above: ... Note that when a message priority exists in a syslog message selector, ...
      (comp.unix.solaris)
    • Re: Whats wrong with this in /etc/syslog.conf ?
      ... Dave wrote: ... Ultra 80 running Solaris 10 update 1. ... severity as defined in RFC 3164 - The BSD Syslog Protocol. ... # if a non-loghost machine chooses to have authentication messages ...
      (comp.unix.solaris)
    • Syslog messages sent to loghost more than once
      ... I'm having an interesting problem with a remote syslog setup. ... (Yes, those are tabs, and loghost is properly defined (only once) ... # if a non-loghost machine chooses to have authentication messages ...
      (SunManagers)