Find the answer to your Linux question:
Results 1 to 1 of 1
Hi guys, this sounds ridiculous but is true. I have a new OpenVZ VPS with Debian Lenny, and now I suddenly found all my log files (/var/log/messages | syslog | ...
Enjoy an ad free experience by logging in. Not a member yet? Register.
  1. #1
    Just Joined!
    Join Date
    Aug 2010
    Posts
    2

    Help Needed: Where has the log gone?


    Hi guys, this sounds ridiculous but is true.

    I have a new OpenVZ VPS with Debian Lenny, and now I suddenly found all my log files (/var/log/messages | syslog | authlog etc.) been "cut" to the time Aug 15 01:44:04! Means all records before this time have gone to the wind!!! A few miniutes ago I still got all the records, which is so strange. I swear I did nothing with my logs. Can you please tell me your best guess for this? Thanks!

    First time from my local ssh log file:
    Code:
    [root at server ~]$ tail -30 /var/log/messages
    Aug 7 08:00:50 server rsyslogd: [origin software="rsyslogd" swVersion="3.18.6" x-pid="13617"] restart
    Aug 7 08:03:29 server shutdown[19568]: shutting down for system reboot
    Aug 7 08:12:31 server kernel: imklog 3.18.6, log source = /proc/kmsg started.
    Aug 7 08:12:31 server rsyslogd: [origin software="rsyslogd" swVersion="3.18.6" x-pid="8043"] restart
    Aug 8 00:50:19 server shutdown[26330]: shutting down for system reboot
    Aug 8 00:50:58 server kernel: Kernel logging (proc) stopped.
    Aug 8 00:51:00 server kernel: imklog 3.18.6, log source = /proc/kmsg started.
    Aug 8 00:51:00 server rsyslogd: [origin software="rsyslogd" swVersion="3.18.6" x-pid="3388"] restart
    Aug 8 00:59:01 server shutdown[3461]: shutting down for system reboot
    Aug 8 00:59:08 server kernel: Kernel logging (proc) stopped.
    Aug 8 01:01:06 server kernel: imklog 3.18.6, log source = /proc/kmsg started.
    Aug 8 01:01:06 server rsyslogd: [origin software="rsyslogd" swVersion="3.18.6" x-pid="18412"] restart
    Aug 9 01:44:03 server kernel: imklog 3.18.6, log source = /proc/kmsg started.
    Aug 9 01:44:03 server rsyslogd: [origin software="rsyslogd" swVersion="3.18.6" x-pid="18412"] restart
    Aug 10 01:44:04 server kernel: imklog 3.18.6, log source = /proc/kmsg started.
    Aug 10 01:44:04 server rsyslogd: [origin software="rsyslogd" swVersion="3.18.6" x-pid="18412"] restart
    Aug 11 01:44:04 server kernel: imklog 3.18.6, log source = /proc/kmsg started.
    Aug 11 01:44:04 server rsyslogd: [origin software="rsyslogd" swVersion="3.18.6" x-pid="18412"] restart
    Aug 12 01:44:02 server kernel: imklog 3.18.6, log source = /proc/kmsg started.
    Aug 12 01:44:02 server rsyslogd: [origin software="rsyslogd" swVersion="3.18.6" x-pid="18412"] restart
    Aug 13 01:44:03 server kernel: imklog 3.18.6, log source = /proc/kmsg started.
    Aug 13 01:44:03 server rsyslogd: [origin software="rsyslogd" swVersion="3.18.6" x-pid="18412"] restart
    Jan 22 06:25:34 server kernel: imklog 3.18.6, log source = /proc/kmsg started.
    Jan 22 06:25:34 server rsyslogd: [origin software="rsyslogd" swVersion="3.18.6" x-pid="20170"] restart
    Aug 14 08:03:49 server kernel: imklog 3.18.6, log source = /proc/kmsg started.
    Aug 14 08:03:49 server rsyslogd: [origin software="rsyslogd" swVersion="3.18.6" x-pid="27750"] restart
    Aug 14 16:57:41 server kernel: imklog 3.18.6, log source = /proc/kmsg started.
    Aug 14 16:57:41 server rsyslogd: [origin software="rsyslogd" swVersion="3.18.6" x-pid="3281"] restart
    Aug 14 20:27:10 server kernel: imklog 3.18.6, log source = /proc/kmsg started.
    Aug 14 20:27:10 server rsyslogd: [origin software="rsyslogd" swVersion="3.18.6" x-pid="31781"] restart
    Then some time later (also from local ssh log):
    Code:
    [root at server ~]$ tail -30 /var/log/messages
    Aug 15 01:44:04 server kernel: imklog 3.18.6, log source = /proc/kmsg started.
    Aug 15 01:44:04 server rsyslogd: [origin software="rsyslogd" swVersion="3.18.6" x-pid="31781"] restart

    Updates:
    I contacted the support and I got this answer. My question is, is it justified? Still, what is your best guess for what happened to my VPS?

    The main node under which the VPS is hosted faced some temporaray issue and the concerned department have worked on it to rectify the issue and improve the performance.
    we checked with the another node too which is hosted under the main node it is too facing the same issue, that is having the logs from Aug 15.But presently your VPS is working fine.Please let us know if any further concerns.
    What kind of main node issue would delete all the logs inside a VPS? Is it even possible for OpenVZ technology?
    Last edited by scyllar; 08-15-2010 at 04:15 AM. Reason: correct typo

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •