I have devices sending syslog, but the /var/adm/messages file is not updating anymore. Here's what I did when it stopped. I wanted to change the location of where the messages are being logged to a SAN drive.
1) Made a backup of syslog.conf
2) Edited the file to change the 2 lines sending messages to /var/adm/messages to another path (maintaining the correct tabs, etc)
3) Refreshed the service using the "kill -HUP <pid>" command
If I try to restart the service using the the command "svcadm restart svc:/system/system-log:default", I see this error in the messages file:
Mar 31 14:02:29 tnsp03350 syslogd: going down on signal 15
Mar 31 14:02:29 tnsp03350 syslogd: Unable to bind syslog port for 0.0.0.0.2.2
Does this mean anything?
I can use the logger command to successfully write to the file.
I also rotated the messages file by renaming it, creating a new one, then refreshing the service - that hasn't helped either.
Please post the contents of syslog.conf before and after the change.
If (and only if) the new syslog.conf is valid, are you in a position to reboot the server?
Btw. There are established techniques for dealing with the size of /var/adm/messages . Giving it space to grow unbounded is not one of them. Renaming the file is not one either. You are dealing with an open file from an active process.
On most systems the system logging process will fail if the log file tries to exceed 2 Gb or if /var/adm runs out of disc space.
How big is the original /var/adm/messages file which may have prompted you to try to relocate the log?
Last edited by methyl; 03-31-2010 at 08:22 PM..
Reason: assorted clarifications
The messages file was over 600mb. Plenty of room on disk.
I submitted a request to have the box rebooted.
The syslog.conf file below is what's in place right now. Not sure if this is original - Splunk was installed on this box so it may have changed it.
After I backed it up, the only changes I made to this file were the 2 paths highlighted in red. Here is the original - my change was simply just a new path - with the tabs retained.
From googling, I read that one of the correct ways to do this was to rename or copy the messages file, then restart the service which is what I did. This is one of the links I used as a guide, although there were many:
I'm sure there was some hardening done, but that would have been done before I got access to the box. SYSLOG WAS working, right up until the point where I tried to make the change.
Here are the permissions of the files in the folder:
drwxrwxr-x 5 adm adm 5 Feb 10 15:13 acct
-rw------- 1 uucp bin 0 Aug 25 2008 aculog
drwxr-xr-x 2 adm adm 2 Mar 3 2009 exacct
-r--r--r-- 1 root root 14302092 Apr 1 15:40 lastlog
drwxr-xr-x 2 adm adm 2 Mar 3 2009 log
-rw-r--r-- 1 root root 0 Mar 31 15:38 messages
-rw-r--r-- 1 root root 502826 Mar 26 03:04 messages.0
-rw-r--r-- 1 root root 6971261 Mar 19 03:07 messages.1
-rw-r--r-- 1 root root 618895 Mar 11 03:09 messages.2
-rw-r--r-- 1 root root 1330218 Mar 4 03:00 messages.3
drwxr-xr-x 2 root sys 2 Mar 3 2009 pool
drwxrwxr-x 2 adm sys 2 Mar 3 2009 sa
-r-------- 1 root root 110 Mar 18 22:04 setpass.log
drwxr-xr-x 2 root sys 2 Mar 3 2009 sm.bin
-rw-rw-rw- 1 root bin 0 Aug 25 2008 spellhist
drwxr-xr-x 2 root sys 2 Mar 3 2009 streams
-rw------- 1 root nhbw13t 4493 Apr 1 08:55 sudo.log
-rw------- 1 root root 216 Mar 25 15:37 sulog
-rw-r--r-- 1 root root 0 Feb 10 15:45 syslog
-rw-r--r-- 1 root bin 3348 Apr 1 12:40 utmpx
-rw-r--r-- 1 root root 0 Mar 3 2009 vold.log
drwxr-xr-x 2 root sys 6 Mar 8 14:35 vx
-rw-r--r-- 1 adm adm 630540 Apr 1 15:40 wtmpx
grep \"^`date "+%b %d %T"`\" /var/adm/messages | egrep \"emerg|alert|crit|err|warning\
but get an output like this
ksh: alert: not found
ksh: crit: not found
ksh: err: not found
ksh: warning": not found
grep: can't open "19"
grep: can't open "16:27:16"" (1 Reply)
The /var/adm/messages in Solaris seem to log more system messages/errors compared to /var/log/messages in Linux.
I checked the log level in Linux and they seem OK.
Is there any other log file that contains the messages or is it just that Linux doesn't log great many things? (2 Replies)
hi sirs
can u tell the difference between /var/log/syslogs and /var/adm/messages
in my working place i am having two servers.
in one servers messages file is empty and syslog file is going on increasing..
and in another servers message file is going on increasing but syslog file is... (2 Replies)
Check message file and result posted below.
Can anyone tell me what this is a sign of, what does it mean?
server1% more messages.0
Dec 02 09:35:06 server1 bsd-gw: Inval
id protocol request (65): AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA^\\2... (6 Replies)
Hello Friends,
I am geting the folowing error in /var/adm/message is it disl related problem?
if yes.. how to check all the disk are perfect or not?
Sep 15 06:01:12 scsi: WARNING: /pci@1f,700000/scsi@2/sd@2,0 (sd7):
Sep 15 06:01:12 Error for Command: write(10) Error Level:... (5 Replies)
I'm running a Solaris 9 box with Oracle databases on it.
I'm getting the following messages in my /var/adm/messages log
"Jun 24 12:30:32 sundb01 bootpd: IP address not found: xxx.xxx.xxx.xxx"
...where xxx.xxx.xxx.xxx is DHCP IP addresses of Windows 2000 workstations in the organisation. ... (2 Replies)
Solaris 8/ sun 420R
Checked /var/adm/messages file and got the following message:
Dec 4 16:40:05 serverXYZ ConfigProvider: get_pkg_instdate: getdate failed for the standard C locale (7)
Does anyone know what this means? Looked up getdate but do not understand....
Thanks. (1 Reply)
Just want to check with all of you out there what does the following warning means in my "messages" file in /var/adm
the warning is Prevous Time Adjustment Incomplete , does it mean my hard ware is faulty if so which piece of hardware it is ? (1 Reply)