Log Maintenance\Rotation Problems

Posted on 2011-04-21
Medium Priority
Last Modified: 2013-12-27
I'm having a problem with my messages and auditlog log files. I think the log rotation is messed up somehow and both services are writing to the <name>.0 file, not the <name> file. Here is what the directory structure looks like:

-rw-r--r--   1 root     root           0 Apr  7 03:10 auditlog
-rw-r--r--   1 root     root       40640 Apr 21 10:36 auditlog.0

-rw-r--r--   1 root     root           0 Apr  7 03:10 messages
-rw-r--r--   1 root     root       54904 Apr 21 10:01 messages.0
-rw-r--r--   1 root     root      101300 Apr  6 11:01 messages.1
-rw-r--r--   1 root     root      300775 Mar 24 10:30 messages.2
-rw-r--r--   1 root     root      474050 Feb  1 09:01 messages.3

you can see that both the messages.0 and the auditlog.0 files have the most recent data in them. What am I doing wrong here?

This is what my logadm.conf file looks like for these two entries:
/var/adm/messages -C 4 -P 'Thu Apr  7 07:10:00 2011' -a 'kill -HUP `cat /var/run/syslog.pid`'
/var/adm/auditlog -C 8 -P 'Thu Apr  7 07:10:00 2011' -a 'kill -HUP `cat /var/run/syslog.pid`'

Question by:IT_Telephonics
  • 4
  • 2

Expert Comment

ID: 35441264
Does /var/run/syslog.pid exist, and is it correct?  It sounds very much like syslog was not restarted, so even though logadm renamed the file, syslog is still writing to the open handle of that file.

Also, do you use the canned syslog daemon, or was it replaced with something else, like syslog-ng?

Author Comment

ID: 35441377
OK, I think your on to something. For some reason syslog.pid is empty but syslog.pid.0 has the correct pid in it.

# ps -ef | grep syslog
    root   526     1   0   Mar 24 ?           0:05 /usr/sbin/syslogd
    root 26250 25666   0 11:11:37 pts/4       0:00 grep syslog

How can I update the syslog.pid file? Do I just use VI to edit it?

Author Comment

ID: 35441388
Also, I believe we are using the canned syslog deamon. Nothing fancy.

Modern healthcare requires a modern cloud. View this brief video to understand how the Concerto Cloud for Healthcare can help your organization.


Accepted Solution

jeremycrussell earned 2000 total points
ID: 35441413
Not sure why you would have a syslog.pid.0, sounds like that file is accidentally being rotated as well.

To correct it, you'll want to restart syslog.

Check your logadm.conf and make sure there's not a typo on a line, or something that would rotate the syslog.pid file.

Author Comment

ID: 35441651

There was an entry in the logadm.conf file that rotated the syslog.pid file. Not sure why that is there but I commented it out. I restarted the syslog service and the correct PID populated the syslog.pid file. The log files are writting to the correct locations now.


Author Closing Comment

ID: 35441656
Thanks Alot!

Featured Post

Keep up with what's happening at Experts Exchange!

Sign up to receive Decoded, a new monthly digest with product updates, feature release info, continuing education opportunities, and more.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

A metadevice consists of one or more devices (slices). It can be expanded by adding slices. Then, it can be grown to fill a larger space while the file system is in use. However, not all UNIX file systems (UFS) can be expanded this way. The conca…
Java performance on Solaris - Managing CPUs There are various resource controls in operating system which directly/indirectly influence the performance of application. one of the most important resource controls is "CPU".   In a multithreaded…
Learn several ways to interact with files and get file information from the bash shell. ls lists the contents of a directory: Using the -a flag displays hidden files: Using the -l flag formats the output in a long list: The file command gives us mor…
This video shows how to set up a shell script to accept a positional parameter when called, pass that to a SQL script, accept the output from the statement back and then manipulate it in the Shell.
Suggested Courses
Course of the Month13 days, 23 hours left to enroll

807 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question