From owner-freebsd-questions Fri Apr 17 20:28:21 1998 Return-Path: Received: (from majordom@localhost) by hub.freebsd.org (8.8.8/8.8.8) id UAA19188 for freebsd-questions-outgoing; Fri, 17 Apr 1998 20:28:21 -0700 (PDT) (envelope-from owner-freebsd-questions@FreeBSD.ORG) Received: from smtp2.globalserve.net (smtp2.globalserve.net [209.90.128.7]) by hub.freebsd.org (8.8.8/8.8.8) with ESMTP id DAA19030 for ; Sat, 18 Apr 1998 03:26:28 GMT (envelope-from geoffr@globalserve.net) Received: from globalserve.net (dialin55.toronto.globalserve.net [209.90.130.55]) by smtp2.globalserve.net (8.8.8/8.8.8) with ESMTP id WAA28047 for ; Fri, 17 Apr 1998 22:23:01 -0500 (EST) (envelope-from geoffr@globalserve.net) Message-ID: <35381CAB.243600D8@globalserve.net> Date: Fri, 17 Apr 1998 23:23:23 -0400 From: Geoffrey Robinson Reply-To: geoffr@globalserve.net X-Mailer: Mozilla 4.03 [en] (Win95; U) MIME-Version: 1.0 To: questions@FreeBSD.ORG Subject: Reading Cycled Logs Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.ORG Hi, I admin a co-hosted server and every few weeks I login to find it has rebooted. I don't know if its a technical problem, a power failure or somebody with root privileges from my ISP doing work on it. My problem is that the last two times its happened the /var/log/messages file had been cycled before I got to it so I can't find out if it was done by a user or not. My question is how do I extract the compressed back logs and how do I determine which log file to decompress? When the messages log is cycled is it numbered 1 and all the other archived logs moved up in number so that the last one is deleted or dose it archive them in a loop. (ie. archives it as messages.1.gz, then messages.2.gz the next time until it reaches the last number and goes back to messages.1.gs ). Thanks in advance for any help. -- Geoffrey Robinson geoffr@globalserve.net Oakville, Ontario, Canada. To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message