Solaris

what files do I need to check....i mean from any specific folder/directory....

let me know..

thnx

That's hard to tell from the distance. At least you have to check:

Code:

/kernel/sys/sparcv9/doorfs
/kernel/sys/sparcv9/nfs
/kernel/fs/sparcv9/nfs

Please check /var/adm/messages for other errors from the kernel runtime loader.

But those are executable files....how to check those....

What if I will replace those files directly using cd or the patch that contains those files.....???

For example, your doofs kernel module requires the kernel function copyout_nowatch.

Code:

$ /usr/ccs/bin/nm /kernel/sys/sparcv9/doorfs | grep copyout_nowatch
[175]   |             0|           0|FUNC |GLOB |0    |UNDEF  |copyout_nowatch

In my case (a Solaris 10 installation), the size and date of the module is

Code:

$ ls -l /kernel/sys/sparcv9/doorfs
-rwxr-xr-x   1 root     sys        61592 Oct  3  2008 /kernel/sys/sparcv9/doorfs

Now, you have to check your backups for an older version of this file. Restore it to a temporary location and check the symbol table with nm and verify, that copyout_nowatch is not an undefined symbol.

I have the following outputs...

# ls -l /kernel/sys/sparcv9/doorfs
-rwxr-xr-x 1 root sys 49496 Feb 12 2010 /kernel/sys/sparcv9/doorfs

# /usr/ccs/bin/nm /kernel/sys/sparcv9/doorfs | grep copyout_nowatch
[74] | 0| 0|FUNC |GLOB |0 |UNDEF |copyout_nowatch

I chacked these on the server on which syslog is not working and also on the server on which syslog is working...

both have the same date and both showing the same "UNDEF" o/p as above......I have solaris -9

What to do???

Hmm, was the server where syslog is not working rebooted and the server with the working syslog not rebooted?

Besides that, I am out of ideas at the moment. It seems, that somehow kernel modules that do not match the kernel have found their way into the system. With regular patching such a mismatch should not have occured. But that's only a diagnosis from the far distance.

nope.........after installation of syslog-ng with dependancies, it wasn't rebooted yet....as its production server....

And the server with syslog working was rebooted 3 month ago (production server too) ...not recently....

I m just hanged....