On Thu, 13 Apr 2000, Togan Muftuoglu wrote:
Jesse Marlin wrote:
Why not? It is a big file, but there is nothing preventing you looking at it. You must be root on most systems, but you can change that. You can do a 'tail -f /var/log/messages' because it is typically big and all you are concerned with is at the end anyway. ^^^^^^^^^^^^^^^ not necessarily
That is I know already yet when I do it there is nothing displayed the file is completely empty.
Oh, THAT problem again. There is a nightly job that checks a great many log files for size. If a log file exceeds a certain size, it is compressed to another name and an empty file of the same name is created. Then this job is SUPPOSED to restart a process, preferably the process that writes the log file - in this case, syslogd. However, in my case I found the configuration file was incorrect, and did NOT restart ANY of the processes it was supposed to. Which caused exactly the symptoms you referred to. In fact I found that manually clobbering /var/log/messages has the same effect. To fix the immediate problem: killall -HUP syslogd This tells syslogd to reinitialize itself, which includes closing all its log files (including the now-invalid one) and reopening them (new, valid connections). You will see that when this is complete, syslogd itself immediately logs the event to /var/log/messages. The configuration file that was incorrect is /etc/logfiles. Here's the valid (I think) line in my file - with a few spaces removed so it will remain one line: /var/log/messages +4096k 640 root.root syslogd I don't remember exactly what the original line looked like - I think there was something else between root.root and syslogd. The column headers in the file are useful in this case. -- To unsubscribe send e-mail to suse-linux-e-unsubscribe@suse.com For additional commands send e-mail to suse-linux-e-help@suse.com Also check the FAQ at http://www.suse.com/Support/Doku/FAQ/