UNIX for Dummies Questions & Answers

hi guys,

so i have a number of log files of different applications, databases and systems.

im curious, what conclusions can i come to if the log file(s) of any application, database or system is not being updated at the regularly intervals it is known to?

what underlying possible problems could this be indicating??

Well i would suspect there are no errors or warnings to log

You can check the log file with fuser or lsof and determine which process is keeping the file open.

Other then that, you will have to login to your app/db/system and determine what is going on and how it is configured to log.

There could be various reasons such as :
Missing disk space.
Files removed with rm while process is attached (you will not see the file anymore, but the process is still writing in it and taking up space until you restart it).
Inode exhaustion (rare on modern filesystems, limits are quite high).
Wrong files/log cleanup (badly configured logrotate and such).
etc.

What is 'expected log update?'. Can you elaborate on this ?

suppose you have a production server. and the /var/log/messages file typically gets updated quite frequently. but all of a sudden, its being updated now every 5 minutes, when before, hardly 30 seconds can go by without it being updated. what would this type of scenario be telling you?

and this is just an example. /var/log/messages can be any log file (application, database, network, system)

Another possibility (although unusual for a process that is writing a log file as opposed to normal output from a short lived process) is that the process writing the log is using fully buffered (instead of line buffered) standard I/O buffering. (With fully buffered I/O, the program writing the log won't update the file until its internal buffer for that file is full. With a fully buffered file, the buffer is typically a multiple of 1024 bytes somewhere in the range of sizes from 1K to 32K bytes; but can be any size the process chooses.)

when the log of an application, database, or system is not updating as it is known to or expected to given its history, here's what i was hoping you guys would be alluding to:

1. the application that normally logs to that log file is not functioning properly. it is sluggish and most likely to be crashing in the near future.

2. a new change has been applied to the application or database which has caused it to behave different. if you didn't make the change, then, u would want to know about this.

3. a hack attempt. someone hacked into the database, application, system and screwed around with it. this can be linked to 2.

4. a lack of activity could mean some part of a web site is not functioning right. i.e. page not loading, or taking too slow, causing users to give up.


hopefully, these can point you guys in the direction i was thinking. and i'm hoping you can add more or suggest other possible reasons.

All that is possible - plus a whole lot of ther things and their opposites in addition.

How are we supposed to anlyse your problem based on the vague "suppose i have something and it does something while previously it did something else". Perhaps the problem is - you guessed it: something! then again, maybe something else.

Describe your environment (applications, OS, versions, topology and whatever might be of influence) and then show some log files and what exactly changed.

You do not call a doctor (mind you, via phone) and ask him for a diagnose based on "i feel different today than i felt yesterday". You go there show to him where it hurts and let him examine.

Until you tell us some necessary information it is all wild guessing and conjecture. An because every guess is as good as any other as long there are no facts to measure it against, here is mine: when the moon is in the seventh house, and Jupiter aligns with Mars....

I hope this helps.

bakunin