The messages file was over 600mb. Plenty of room on disk.
I submitted a request to have the box rebooted.
The syslog.conf file below is what's in place right now. Not sure if this is original - Splunk was installed on this box so it may have changed it.
After I backed it up, the only changes I made to this file were the 2 paths highlighted in red. Here is the original - my change was simply just a new path - with the tabs retained.
From googling, I read that one of the correct ways to do this was to rename or copy the messages file, then restart the service which is what I did. This is one of the links I used as a guide, although there were many:
I'm sure there was some hardening done, but that would have been done before I got access to the box. SYSLOG WAS working, right up until the point where I tried to make the change.
Here are the permissions of the files in the folder:
drwxrwxr-x 5 adm adm 5 Feb 10 15:13 acct
-rw------- 1 uucp bin 0 Aug 25 2008 aculog
drwxr-xr-x 2 adm adm 2 Mar 3 2009 exacct
-r--r--r-- 1 root root 14302092 Apr 1 15:40 lastlog
drwxr-xr-x 2 adm adm 2 Mar 3 2009 log
-rw-r--r-- 1 root root 0 Mar 31 15:38 messages
-rw-r--r-- 1 root root 502826 Mar 26 03:04 messages.0
-rw-r--r-- 1 root root 6971261 Mar 19 03:07 messages.1
-rw-r--r-- 1 root root 618895 Mar 11 03:09 messages.2
-rw-r--r-- 1 root root 1330218 Mar 4 03:00 messages.3
drwxr-xr-x 2 root sys 2 Mar 3 2009 pool
drwxrwxr-x 2 adm sys 2 Mar 3 2009 sa
-r-------- 1 root root 110 Mar 18 22:04 setpass.log
drwxr-xr-x 2 root sys 2 Mar 3 2009 sm.bin
-rw-rw-rw- 1 root bin 0 Aug 25 2008 spellhist
drwxr-xr-x 2 root sys 2 Mar 3 2009 streams
-rw------- 1 root nhbw13t 4493 Apr 1 08:55 sudo.log
-rw------- 1 root root 216 Mar 25 15:37 sulog
-rw-r--r-- 1 root root 0 Feb 10 15:45 syslog
-rw-r--r-- 1 root bin 3348 Apr 1 12:40 utmpx
-rw-r--r-- 1 root root 0 Mar 3 2009 vold.log
drwxr-xr-x 2 root sys 6 Mar 8 14:35 vx
-rw-r--r-- 1 adm adm 630540 Apr 1 15:40 wtmpx
Just want to check with all of you out there what does the following warning means in my "messages" file in /var/adm
the warning is Prevous Time Adjustment Incomplete , does it mean my hard ware is faulty if so which piece of hardware it is ? (1 Reply)
Solaris 8/ sun 420R
Checked /var/adm/messages file and got the following message:
Dec 4 16:40:05 serverXYZ ConfigProvider: get_pkg_instdate: getdate failed for the standard C locale (7)
Does anyone know what this means? Looked up getdate but do not understand....
Thanks. (1 Reply)
I'm running a Solaris 9 box with Oracle databases on it.
I'm getting the following messages in my /var/adm/messages log
"Jun 24 12:30:32 sundb01 bootpd: IP address not found: xxx.xxx.xxx.xxx"
...where xxx.xxx.xxx.xxx is DHCP IP addresses of Windows 2000 workstations in the organisation. ... (2 Replies)
Hello Friends,
I am geting the folowing error in /var/adm/message is it disl related problem?
if yes.. how to check all the disk are perfect or not?
Sep 15 06:01:12 scsi: WARNING: /pci@1f,700000/scsi@2/sd@2,0 (sd7):
Sep 15 06:01:12 Error for Command: write(10) Error Level:... (5 Replies)
Check message file and result posted below.
Can anyone tell me what this is a sign of, what does it mean?
server1% more messages.0
Dec 02 09:35:06 server1 bsd-gw: Inval
id protocol request (65): AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA^\\2... (6 Replies)
hi sirs
can u tell the difference between /var/log/syslogs and /var/adm/messages
in my working place i am having two servers.
in one servers messages file is empty and syslog file is going on increasing..
and in another servers message file is going on increasing but syslog file is... (2 Replies)
The /var/adm/messages in Solaris seem to log more system messages/errors compared to /var/log/messages in Linux.
I checked the log level in Linux and they seem OK.
Is there any other log file that contains the messages or is it just that Linux doesn't log great many things? (2 Replies)
grep \"^`date "+%b %d %T"`\" /var/adm/messages | egrep \"emerg|alert|crit|err|warning\
but get an output like this
ksh: alert: not found
ksh: crit: not found
ksh: err: not found
ksh: warning": not found
grep: can't open "19"
grep: can't open "16:27:16"" (1 Reply)