Date: Sat, 26 May 2012 21:51:37 +0100 From: Matthew Seaman <matthew@FreeBSD.org> To: Jos Chrispijn <jos@webrz.net> Cc: freebsd-questions@FreeBSD.org Subject: Re: NewSysLog | Crontab Message-ID: <4FC14259.4020904@FreeBSD.org> In-Reply-To: <4FC115D5.7000502@webrz.net> References: <4FC0B862.80306@webrz.net> <4FC0C217.6050600@FreeBSD.org> <4FC115D5.7000502@webrz.net>
next in thread | previous in thread | raw e-mail | index | archive | help
This is an OpenPGP/MIME signed message (RFC 2440 and 3156)
--------------enig317C34A597EEA984CD1F471E
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
On 26/05/2012 18:41, Jos Chrispijn wrote:
> Thanks, will investigate this...
Keeping the list in the loop...
> % df -ih /var/log
>=20
> Filesystem Size Used Avail Capacity iused ifree %iused Mounted on
> /dev/ada0p2 453G 5.8G 411G 1% 468k 29M 2% /
One big partition for the whole OS?
> % ls -laoR /var/log
>=20
> total 448
> drwxr-xr-x 5 root wheel - 1024 May 26 00:00 .
> drwxr-xr-x 23 root wheel - 512 May 17 19:57 ..
> drwx------ 2 root wheel - 512 May 22 23:30 .spamassassin
> -rw-r--r-- 1 root wheel - 1 May 23 16:04 Minimalist.log
> -rw------- 1 root wheel - 60 May 26 00:00 all.log
> -rw------- 1 root wheel - 14 May 26 00:00 all.log.0.bz2
> -rw------- 1 root wheel - 14 May 25 00:00 all.log.2.bz2
> -rw------- 1 root wheel - 14 May 24 00:00 all.log.4.bz2
> -rw------- 1 root wheel - 14 May 23 00:00 all.log.6.bz2
Oooh, fun. None of the obvious ideas were right, and this is looking
really quite mysterious. You've only got even numbered versions of
all.log backups, but they are spaced 1 day apart, which is the usual
recycle timing for all.log.
However, there's not much in your all.log at all. It should get at
least a message every 5 minutes assuming it's configured. Did you turn
on the all.log in /etc/syslogd.conf at all? Or do those 60 bytes in
all.log just say something very much like this:
# cat /var/log/all.log
May 26 00:00:00 lucid-nonsense newsyslog[23677]: logfile turned over
(obviously, with your hostname instead and a different PID for
newsyslog, and maybe a different date.)
In which case, you're not actually logging anything to all.log at all,
and you could just make the whole thing go away by:
# cd /var/log
# rm all.log*
But that's no fun at all, and doesn't go anywhere towards explaining why
you only get even numbered backups.
Can we check a few things please?
* Have you modified /etc/newsyslog.conf at all? Or
/etc/syslogd.conf ? What does this command return for you?
% grep all.log /etc/syslog.conf /etc/newsyslog.conf
* What happens when you run the following sequence of commands:
# cd /var/log
# echo test > foo
# bzip2 -f foo || echo $?
# ls -la foo*
(using script(1) to capture a console transcript would be a good
thing here.)
Assuming you end up with a foo.bz2 file 45 bytes long, then you
should also be able to do this:
# bzcat foo.bz2=09
test
* What version of FreeBSD is this, how did you install it and have
you applied any patches or made any unusual configuration choices
or modifications to the system? Is there anything out of the
ordinary with your hardware or the setup on the machine that you
think might be relevant? Does it have any history of problems?
Did anything about the system change recently?
Cheers,
Matthew
--=20
Dr Matthew J Seaman MA, D.Phil.
PGP: http://www.infracaninophile.co.uk/pgpkey
--------------enig317C34A597EEA984CD1F471E
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.16 (Darwin)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
iEYEARECAAYFAk/BQmEACgkQ8Mjk52CukIzNNgCfSgtacZmh/RfpniemAX+KufOg
LpoAoId5YMklmHERevEBVYmQcdRDbeet
=osQV
-----END PGP SIGNATURE-----
--------------enig317C34A597EEA984CD1F471E--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?4FC14259.4020904>