Log Maintenance\Rotation Problems

Posted on 2011-04-21
Last Modified: 2013-12-27
I'm having a problem with my messages and auditlog log files. I think the log rotation is messed up somehow and both services are writing to the <name>.0 file, not the <name> file. Here is what the directory structure looks like:

-rw-r--r--   1 root     root           0 Apr  7 03:10 auditlog
-rw-r--r--   1 root     root       40640 Apr 21 10:36 auditlog.0

-rw-r--r--   1 root     root           0 Apr  7 03:10 messages
-rw-r--r--   1 root     root       54904 Apr 21 10:01 messages.0
-rw-r--r--   1 root     root      101300 Apr  6 11:01 messages.1
-rw-r--r--   1 root     root      300775 Mar 24 10:30 messages.2
-rw-r--r--   1 root     root      474050 Feb  1 09:01 messages.3

you can see that both the messages.0 and the auditlog.0 files have the most recent data in them. What am I doing wrong here?

This is what my logadm.conf file looks like for these two entries:
/var/adm/messages -C 4 -P 'Thu Apr  7 07:10:00 2011' -a 'kill -HUP `cat /var/run/`'
/var/adm/auditlog -C 8 -P 'Thu Apr  7 07:10:00 2011' -a 'kill -HUP `cat /var/run/`'

Question by:IT_Telephonics
    LVL 9

    Expert Comment

    Does /var/run/ exist, and is it correct?  It sounds very much like syslog was not restarted, so even though logadm renamed the file, syslog is still writing to the open handle of that file.

    Also, do you use the canned syslog daemon, or was it replaced with something else, like syslog-ng?

    Author Comment

    OK, I think your on to something. For some reason is empty but has the correct pid in it.

    # ps -ef | grep syslog
        root   526     1   0   Mar 24 ?           0:05 /usr/sbin/syslogd
        root 26250 25666   0 11:11:37 pts/4       0:00 grep syslog

    How can I update the file? Do I just use VI to edit it?

    Author Comment

    Also, I believe we are using the canned syslog deamon. Nothing fancy.
    LVL 9

    Accepted Solution

    Not sure why you would have a, sounds like that file is accidentally being rotated as well.

    To correct it, you'll want to restart syslog.

    Check your logadm.conf and make sure there's not a typo on a line, or something that would rotate the file.

    Author Comment

    SPOT ON!!

    There was an entry in the logadm.conf file that rotated the file. Not sure why that is there but I commented it out. I restarted the syslog service and the correct PID populated the file. The log files are writting to the correct locations now.


    Author Closing Comment

    Thanks Alot!

    Featured Post

    What Is Threat Intelligence?

    Threat intelligence is often discussed, but rarely understood. Starting with a precise definition, along with clear business goals, is essential.

    Join & Write a Comment

    Let's say you need to move the data of a file system from one partition to another. This generally involves dismounting the file system, backing it up to tapes, and restoring it to a new partition. You may also copy the file system from one place to…
    Using libpcap/Jpcap to capture and send packets on Solaris version (10/11) Library used: 1.      Libpcap ( Version 1.2 2.      Jpcap( Version 0.6 Prerequisite: 1.      GCC …
    Learn how to get help with Linux/Unix bash shell commands. Use help to read help documents for built in bash shell commands.: Use man to interface with the online reference manuals for shell commands.: Use man to search man pages for unknown command…
    In a previous video, we went over how to export a DynamoDB table into Amazon S3.  In this video, we show how to load the export from S3 into a DynamoDB table.

    746 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    17 Experts available now in Live!

    Get 1:1 Help Now