Linux AS 5.3 的messages日志无法记录

chen_7733

OS:Red Hat Enterprise Linux Server release 5.3 (Tikanga)/DEll 2950
问题描述:
发现/var/log/messages 无法记录新的信息:
# ls -l mess*
-rw------- 1 root root  2474 May 27 17:54 messages
-rw------- 1 root root   114 May 21 18:10 messages.1
-rw------- 1 root root    46 May  9 04:02 messages.2
-rw------- 1 root root 28969 May  9 04:02 messages.3
-rw------- 1 root root    46 Apr 25 04:02 messages.4
----
#cat messages
May 23 04:02:02 demo syslogd 1.4.1: restart.
May 27 13:53:08 demo kernel: Kernel logging (proc) stopped.
May 27 13:53:08 demo kernel: Kernel log daemon terminating.
May 27 13:53:09 demo exiting on signal 15
May 27 13:53:09 demo syslogd 1.4.1: restart.
May 27 13:53:09 demo kernel: klogd 1.4.1, log source = /proc/kmsg started.
May 27 17:37:36 demo gconfd (root-12941): starting (version 2.14.0), pid 12941 user 'root'
May 27 17:37:36 demo gconfd (root-12941): Resolved address "xml:readonly:/etc/gconf/gconf.xml.mandatory" to a read-only configuration source at position 0
May 27 17:37:36 demo gconfd (root-12941): Resolved address "xml:readwrite:/root/.gconf" to a writable configuration source at position 1
May 27 17:37:36 demo gconfd (root-12941): Resolved address "xml:readonly:/etc/gconf/gconf.xml.defaults" to a read-only configuration source at position 2
May 27 17:43:36 demo kernel: Kernel logging (proc) stopped.
May 27 17:43:36 demo kernel: Kernel log daemon terminating.
May 27 17:43:37 demo exiting on signal 15
May 27 17:43:37 demo syslogd 1.4.1: restart.
May 27 17:43:37 demo kernel: klogd 1.4.1, log source = /proc/kmsg started.
May 27 17:47:26 demo ntpd[14159]: ntpd 4.2.2p1@1.1570-o Wed Sep  3 14:28:29 UTC 2008 (1)
May 27 17:47:26 demo ntpd[14160]: precision = 1.000 usec
May 27 17:47:26 demo ntpd[14160]: Listening on interface wildcard, 0.0.0.0#123 Disabled
May 27 17:47:26 demo ntpd[14160]: Listening on interface wildcard, ::#123 Disabled
May 27 17:47:26 demo ntpd[14160]: Listening on interface lo, ::1#123 Enabled
May 27 17:47:26 demo ntpd[14160]: Listening on interface eth0, fe80::222:19ff:fec8:81b6#123 Enabled
May 27 17:47:26 demo ntpd[14160]: Listening on interface lo, 127.0.0.1#123 Enabled
May 27 17:47:26 demo ntpd[14160]: Listening on interface eth0, 192.168.0.58#123 Enabled
May 27 17:47:26 demo ntpd[14160]: kernel time sync status 0040
May 27 17:47:27 demo ntpd[14160]: frequency initialized 0.000 PPM from /var/lib/ntp/drift
May 27 17:47:41 demo ntpd[14160]: ntpd exiting on signal 15
May 27 17:52:49 demo kernel: Kernel logging (proc) stopped.
May 27 17:52:49 demo kernel: Kernel log daemon terminating.
May 27 17:52:50 demo exiting on signal 15
May 27 17:52:50 demo syslogd 1.4.1: restart.
May 27 17:52:50 demo kernel: klogd 1.4.1, log source = /proc/kmsg started.
May 27 17:54:36 demo gconfd (root-12941): GConf server is not in use, shutting down.
May 27 17:54:36 demo gconfd (root-12941): Exiting
------截止到现在,28日的信息一点都没有,我昨天13:53重启过syslog.
大家帮忙分析一下是什么原因导致无法写入messages? 难道系统没有任何问题?

vermouth

检查 syslog 运行情况，看看空间还够不。

chen_7733

1.---
#ps -ef|grep syslog
root     14841     1  0 May27 ?        00:00:00 syslogd -m 0
root     20216 19462  0 11:33 pts/3    00:00:00 grep syslog

# service --status-all|grep syslogd
syslogd (pid 14841) is running...
2.--
# df -h
Filesystem            Size  Used Avail Use% Mounted on
/dev/sda3             9.7G  786M  8.5G   9% /
/dev/sda8              45G  6.0G   37G  15% /usr
/dev/sda7             7.8G  290M  7.1G   4% /tmp
/dev/sda6              20G  344M   19G   2% /var
3.--
我用logger 可以把信息写入到/var/log/messages 中? 我有个疑惑,messages中时间戳是连续的吗?

chen_7733

等待高手解决中.....

chen_7733

还是没有人回答俺呀...
如果系统没有问题的话,是不是也不会去更新messages

jerrywjl

这当然要看具体情况，如果是没有触发日志级别的问题，自然不会有日志记录。这不代表你的syslog有问题。

所以我想看看，比如说你重启一下network，看看有否日志记录。如果这个操作没有日志记录，那么syslog会有问题了。