Professional Web Applications Themes

No syslog entries on Sunday's & Monday's - SCO

I have a SCO 5.0.6 server. I have a script that moves the syslog daily. For some reason there are never any entries in there on Sunday and Monday. I am not sure if the script is causing the problem. Right now (Monday) if I review the /var/adm/syslog it is zero bytes. This is not right as my FTP server logs all details to syslog. script: mv /var/adm/syslog /u/logs/ftpxfers/syslog.`date +\%m\%d`  root cron entry: 59 23 * * * /u/bin/movesyslog >/dev/null 2>&1 /etc/syslog.conf: *.debug /usr/adm/syslog Thanks Gary Quiring...

  1. #1

    Default No syslog entries on Sunday's & Monday's

    I have a SCO 5.0.6 server. I have a script that moves the syslog daily. For
    some reason there are never any entries in there on Sunday and Monday. I am not
    sure if the script is causing the problem. Right now (Monday) if I review the
    /var/adm/syslog it is zero bytes. This is not right as my FTP server logs all
    details to syslog.

    script:
    mv /var/adm/syslog /u/logs/ftpxfers/syslog.`date +\%m\%d` 

    root cron entry:
    59 23 * * * /u/bin/movesyslog >/dev/null 2>&1

    /etc/syslog.conf:
    *.debug /usr/adm/syslog

    Thanks
    Gary Quiring

    Gary Guest

  2. #2

    Default RE: No syslog entries on Sunday's & Monday's


     
    >
    > root cron entry:
    > 59 23 * * * /u/bin/movesyslog >/dev/null 2>&1
    >
    > /etc/syslog.conf:
    > *.debug /usr/adm/syslog
    >[/ref]
    Not sure, but I think you need to restart (kill -1) syslog to get it writing
    to the "new" file even though it's the same name as the "old" file.

    Fabio

    Fabio Guest

  3. #3

    Default Re: No syslog entries on Sunday's & Monday's

    Fabio Giannotti wrote:
     
    >>
    >>root cron entry:
    >>59 23 * * * /u/bin/movesyslog >/dev/null 2>&1
    >>
    >>/etc/syslog.conf:
    >>*.debug /usr/adm/syslog
    >>[/ref]
    >
    > Not sure, but I think you need to restart (kill -1) syslog to get it writing
    > to the "new" file even though it's the same name as the "old" file.
    >[/ref]

    Yes, the way I understand it, certain daemons hold their logfiles open
    permanently rather than opening and closing for each write.

    If you rename the logfile (mv to same fs), the deamon will keep writing
    to the same file (inode) despite its change of name. The daemon won't
    even notice there has been any change. In this case you'll get extra
    data seemingly appended to a specific days file, e.g. wed+thu data in a
    weds file.

    If you delete the file (mv across fs), the daemon will continue to write
    to the "deleted" file. The file has no directory entry but has space
    allocated in the inode tables etc. The actual deletion of data only
    occurs when the daemon finally releases the file. In this latter case
    you'll lose the data.

    So generally you should signal the daemon when renaming, moving or
    deleting its log file. Usually a HUP signal causes a daemon to reload
    its config and to close and reopen its log files, but check man pages
    for the specific daemon (i.e. syslog).


    Ian Guest

  4. #4

    Default Re: No syslog entries on Sunday's & Monday's

    On Tue, 18 Nov 2003 10:42:24 +0000 (UTC), Ian Wilson <co.uk>
    wrote:
     
    >>
    >> Not sure, but I think you need to restart (kill -1) syslog to get it writing
    >> to the "new" file even though it's the same name as the "old" file.
    >>[/ref]
    >
    >Yes, the way I understand it, certain daemons hold their logfiles open
    >permanently rather than opening and closing for each write.
    >
    >If you rename the logfile (mv to same fs), the deamon will keep writing
    >to the same file (inode) despite its change of name. The daemon won't
    >even notice there has been any change. In this case you'll get extra
    >data seemingly appended to a specific days file, e.g. wed+thu data in a
    >weds file.
    >
    >If you delete the file (mv across fs), the daemon will continue to write
    >to the "deleted" file. The file has no directory entry but has space
    >allocated in the inode tables etc. The actual deletion of data only
    >occurs when the daemon finally releases the file. In this latter case
    >you'll lose the data.
    >
    >So generally you should signal the daemon when renaming, moving or
    >deleting its log file. Usually a HUP signal causes a daemon to reload
    >its config and to close and reopen its log files, but check man pages
    >for the specific daemon (i.e. syslog).
    >[/ref]
    It makes sense now. We reboot the server Monday nights which would explain why
    it starts logging on Tuesday. I have changed the script to copy the files to
    maintain the inode instead of moving it.

    Thanks
    Gary

    Gary Guest

Similar Threads

  1. Syslog replay script for centralized syslog data
    By leroy in forum Linux / Unix Administration
    Replies: 2
    Last Post: October 29th, 07:52 AM
  2. SYSLOG generating duplicate entries
    By Greg G in forum Linux / Unix Administration
    Replies: 3
    Last Post: November 1st, 01:05 PM
  3. Replies: 3
    Last Post: July 23rd, 03:47 PM

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139