Joel Gomberg wrote:
John DeDourek wrote:
David Timms wrote:
Hi, I'm on FC6 machine that gets updated at least once a week. I
notice today {monday}, that messages has been rotated and is empty so
far.
-rw------- 1 root root 0 Apr 8 09:07 /var/log/messages
-rw------- 1 root root 326802 Apr 5 07:03 /var/log/messages.1
-rw------- 1 root root 632374 Apr 1 04:05 /var/log/messages.2
-rw------- 1 root root 273450 Mar 25 11:06 /var/log/messages.3
-rw------- 1 root root 89829 Mar 20 18:53 /var/log/messages.4
Since the machine has been shutdown and rebooted 3/4 times since
Apr5, it seems that no data is getting to this log. The machine has
been on for many hours almost every day since (now Apr9). Normally
yum log items are also logged to messages, but there have been none
of these in this time frame.
Apr 04 22:21:30 Updated: VMware-server.i386 1.0.2-39867
Apr 04 22:34:16 Updated: VMware-server-console.i386 1.0.2-39867
Frank:
# service syslog status
syslogd (pid 2814) is running...
klogd (pid 2818) is running...
VMware server updates have the nasty habit of modifying /etc/services
and changing its SeLinux context. Running restorecon /etc/services as
root should fix the problem.
# ls -lZ /etc/serv*
-rw-r--r-- root root user_u:object_r:rpm_script_tmp_t /etc/services
# restorecon -v /etc/services
restorecon reset /etc/services context
user_u:object_r:rpm_script_tmp_t:s0->system_u:object_r:etc_t:s0
# ls -lZ /etc/ser*
-rw-r--r-- root root system_u:object_r:etc_t /etc/services
So the se context was incorrect. It didn't seem to start logging
immediately {ie on an ssh login}.
# service syslog restart
And now /var/log/messages is being updated like normal.
Thanks Joel :)
John: Do you have vmware {of some flavour} installed ? (I guess Joel's
hunch would apply to any of their apps that use an .pl install script).
Since the vmware-server install is from their rpm package, I am going to
post there:
http://www.vmware.com/community/thread.jspa?messageID=617291
DaveT.
