What's deleting my log files ?

**Hedgealot** · 10-31-2005

Morning all

In a nutshell I have a PC-esque system that is running a 10.? Slackware distribution and every time I reboot it I lose the log files in /var/log ( messages, syslog, secure, snmpd etc ) as well as the *.1 etc versions. This obviously makes it difficult to debug a problem I am having with the system dying on me.

For my sins I normally work in the AIX world ( I know - I'm sorry ) so I have some idea about what to try and where to look. I tried restarting syslogd to see if it was deleting the files and it didn't. I can't see how logrotate can have any influence here as it only runs once a day via a daily cron. I've done some searches and can't see any startup or shutdown scripts meddling with the contents of /var/log. Lastly I copied some logs to create fred and fred.1 and fred.2 and they were also deleted when I rebooted so whatever is doing it doesn't seem to be too selective.

I've had a good look around the forums and google and I can't see anything on this.

Other details: I am running a 2.4.21 kernel with some mods for an inhouse special keyboard and Xserver.

Thanks in advance to anyone willing to spend the time to have a think about this.

Hedgealot

**kern** · 10-31-2005

is it logrotate?

check roots cron jobs to see if theres such a job

**Hedgealot** · 10-31-2005

As I said - I can't see how logrotate has any influence as it runs once a day ( at 04:40 AM ) and the problem happens on every reboot. I did have a butchers anyway and there is nothing explicite in the logrotate to do any deletes. Both the logrotate and cron setups are as installed.

**kern** · 10-31-2005

ah sorry, I missed that

odd, hmm.

**Hedgealot** · 10-31-2005

Just to make very sure I chmod-ed all logrotate executables out of the equation and rebooted - again the log files have gone and never called me mother.

**michael56** · 11-01-2005

Are you getting clean shutdowns? I'm wondering if the logs are open for writing and the system tanks, perhaps causing them to be lost.

**kern** · 11-01-2005

really stupid, but is /var read only?

¬_¬, or even a ramdisk, ahem, that would cause all changes to be lost on reboot I guess.

**Hedgealot** · 11-02-2005

The shutdowns I am carrying out are by hand - shutdown -fr now. I've also tried a halt - shutdown -fh now - and the result is the same.

Interesting that you should ask about it being read only - it is all under a / filesystem which is read only but it obviously does something cunning such that the log files can be updated as normal. Is it possible that the log files are updated but when the reboot occurs they are not actually flushed to disk because it is a read only filesystem ? This goes a bit beyond my understanding of how ro filesystems work ...

Don't tell me ... this makes me really stupid ?

Assuming this is the case is there a way to force a flush of the files ?

**Hedgealot** · 11-02-2005

Ah-ha !!! damn those ramfs'es. You hit the nail on the head. At bootup the system is doing some meddling with /var and mounting as a ramfs but somehow ( and this was the bit I didn't get ) it puts a couple of files in there which it must be copying from some dark corner.

I think I'm sorted now. My thanks goes out to you all .....

**kern** · 11-02-2005

hah! excellent

Thread Tools

Display

What's deleting my log files ?

Posting Permissions