Bizarre logs problem

[thoroughfare]

Hi guys,

I've got a weird issue on my FreeBSD 6.0 box. Log files are present in compressed form, but not uncompressed:

e.g. 'messages.0.bz2' but no sign of 'messages'

...from the dates, it looks as though no new logs are being created. Any ideas?

Many thanks,
Matt

[Chrysalis]

newsyslog does the log rotation, it is supposed to generate the new files as to why it isnt I dont know.

Confirm newsyslog even runs.

If its running then check if it is able to create new files and nothing might be blocking it.

I would be interested to know if the .0 files are out of date as it makes no sense that it can archive a non existant file.

[thoroughfare]

Hi Chrysalis,

Thanks for your reply. It seems that syslogd is running, but not newsyslogd:

#ps aux | grep syslog
root 460 0.0 0.0 1296 620 ?? Ss Sat02AM 0:04.58 /usr/sbin/syslogd -ss

I've tried /etc/rc.d/newsyslog restart with no luck. Isn't newsyslogd part of the base system? If so, why is syslogd in their as well?

The .0 files are about 3 days old - when I upgraded to 6.0

Matt

[Chrysalis]

newsyslog is ran at intervals via the crontab, check if its in /etc/crontab it isnt a daemon that stays running.

[thoroughfare]

Hi Chrysalis,

I thought newsyslogd was a drop-in replacement for syslogd? Or is syslogd that does the system logging, then newsyslog rotates it?

It's in /etc/crontab to run every hour. When I run newsyslog -v I get stuff like:

/var/log/messages <5J>: does not exist, skipped.

Would that be a problem with syslogd?

Many thanks,
Matt

[thoroughfare]

I fixed it; just had to recreate the missing log files and it seems to be working ok after a restart. Can someone post a directory listing for /var/log on FreeBSD with DA so I can check my permissions aren't too strict?

Many thanks,
Matt

[Chrysalis]

yes the log has to exist in the first place for it to work