Find the answer to your Linux question:
Results 1 to 10 of 10
Morning all In a nutshell I have a PC-esque system that is running a 10.? Slackware distribution and every time I reboot it I lose the log files in /var/log ...
Enjoy an ad free experience by logging in. Not a member yet? Register.
  1. #1
    Just Joined!
    Join Date
    Oct 2005
    Location
    Down south in UK
    Posts
    5

    What's deleting my log files ?


    Morning all

    In a nutshell I have a PC-esque system that is running a 10.? Slackware distribution and every time I reboot it I lose the log files in /var/log ( messages, syslog, secure, snmpd etc ) as well as the *.1 etc versions. This obviously makes it difficult to debug a problem I am having with the system dying on me.

    For my sins I normally work in the AIX world ( I know - I'm sorry ) so I have some idea about what to try and where to look. I tried restarting syslogd to see if it was deleting the files and it didn't. I can't see how logrotate can have any influence here as it only runs once a day via a daily cron. I've done some searches and can't see any startup or shutdown scripts meddling with the contents of /var/log. Lastly I copied some logs to create fred and fred.1 and fred.2 and they were also deleted when I rebooted so whatever is doing it doesn't seem to be too selective.

    I've had a good look around the forums and google and I can't see anything on this.

    Other details: I am running a 2.4.21 kernel with some mods for an inhouse special keyboard and Xserver.

    Thanks in advance to anyone willing to spend the time to have a think about this.

    Hedgealot

  2. #2
    Linux Enthusiast
    Join Date
    Jun 2005
    Posts
    668
    is it logrotate?

    check roots cron jobs to see if theres such a job

  3. #3
    Just Joined!
    Join Date
    Oct 2005
    Location
    Down south in UK
    Posts
    5
    As I said - I can't see how logrotate has any influence as it runs once a day ( at 04:40 AM ) and the problem happens on every reboot. I did have a butchers anyway and there is nothing explicite in the logrotate to do any deletes. Both the logrotate and cron setups are as installed.

  4. #4
    Linux Enthusiast
    Join Date
    Jun 2005
    Posts
    668
    ah sorry, I missed that

    odd, hmm.

  5. #5
    Just Joined!
    Join Date
    Oct 2005
    Location
    Down south in UK
    Posts
    5
    Just to make very sure I chmod-ed all logrotate executables out of the equation and rebooted - again the log files have gone and never called me mother.

  6. #6
    Just Joined!
    Join Date
    Oct 2005
    Location
    North Carolina, USA
    Posts
    45
    Are you getting clean shutdowns? I'm wondering if the logs are open for writing and the system tanks, perhaps causing them to be lost.

  7. #7
    Linux Enthusiast
    Join Date
    Jun 2005
    Posts
    668
    really stupid, but is /var read only?

    _, or even a ramdisk, ahem, that would cause all changes to be lost on reboot I guess.


  8. #8
    Just Joined!
    Join Date
    Oct 2005
    Location
    Down south in UK
    Posts
    5
    The shutdowns I am carrying out are by hand - shutdown -fr now. I've also tried a halt - shutdown -fh now - and the result is the same.

    Interesting that you should ask about it being read only - it is all under a / filesystem which is read only but it obviously does something cunning such that the log files can be updated as normal. Is it possible that the log files are updated but when the reboot occurs they are not actually flushed to disk because it is a read only filesystem ? This goes a bit beyond my understanding of how ro filesystems work ...

    Don't tell me ... this makes me really stupid ?

    Assuming this is the case is there a way to force a flush of the files ?

  9. #9
    Just Joined!
    Join Date
    Oct 2005
    Location
    Down south in UK
    Posts
    5
    Ah-ha !!! damn those ramfs'es. You hit the nail on the head. At bootup the system is doing some meddling with /var and mounting as a ramfs but somehow ( and this was the bit I didn't get ) it puts a couple of files in there which it must be copying from some dark corner.

    I think I'm sorted now. My thanks goes out to you all .....

  10. #10
    Linux Enthusiast
    Join Date
    Jun 2005
    Posts
    668
    hah! excellent

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •