/var/log/messages is not getting new data.
David Timms
dtimms at iinet.net.au
Mon Apr 9 13:09:11 UTC 2007
Joel Gomberg wrote:
> John DeDourek wrote:
>> David Timms wrote:
>>> Hi, I'm on FC6 machine that gets updated at least once a week. I
>>> notice today {monday}, that messages has been rotated and is empty so
>>> far.
>>> -rw------- 1 root root 0 Apr 8 09:07 /var/log/messages
>>> -rw------- 1 root root 326802 Apr 5 07:03 /var/log/messages.1
>>> -rw------- 1 root root 632374 Apr 1 04:05 /var/log/messages.2
>>> -rw------- 1 root root 273450 Mar 25 11:06 /var/log/messages.3
>>> -rw------- 1 root root 89829 Mar 20 18:53 /var/log/messages.4
>>>
>>> Since the machine has been shutdown and rebooted 3/4 times since
>>> Apr5, it seems that no data is getting to this log. The machine has
>>> been on for many hours almost every day since (now Apr9). Normally
>>> yum log items are also logged to messages, but there have been none
>>> of these in this time frame.
>
>>> Apr 04 22:21:30 Updated: VMware-server.i386 1.0.2-39867
>>> Apr 04 22:34:16 Updated: VMware-server-console.i386 1.0.2-39867
Frank:
# service syslog status
syslogd (pid 2814) is running...
klogd (pid 2818) is running...
> VMware server updates have the nasty habit of modifying /etc/services
> and changing its SeLinux context. Running restorecon /etc/services as
> root should fix the problem.
# ls -lZ /etc/serv*
-rw-r--r-- root root user_u:object_r:rpm_script_tmp_t /etc/services
# restorecon -v /etc/services
restorecon reset /etc/services context
user_u:object_r:rpm_script_tmp_t:s0->system_u:object_r:etc_t:s0
# ls -lZ /etc/ser*
-rw-r--r-- root root system_u:object_r:etc_t /etc/services
So the se context was incorrect. It didn't seem to start logging
immediately {ie on an ssh login}.
# service syslog restart
And now /var/log/messages is being updated like normal.
Thanks Joel :)
John: Do you have vmware {of some flavour} installed ? (I guess Joel's
hunch would apply to any of their apps that use an .pl install script).
Since the vmware-server install is from their rpm package, I am going to
post there:
http://www.vmware.com/community/thread.jspa?messageID=617291
DaveT.
More information about the users
mailing list