Re: [leafnode-list] Logging Stopped; restart syslog needed

["Mike Vanecek" <leaf_list@xxxxxxxxxxxxx>]

On Sat, 05 Jul 2003 01:15:51 +0200, Matthias Andree wrote
> "Mike Vanecek" <leaf_list@xxxxxxxxxxxxx> writes:
> 
> >> Most syslogd implementations will close their files and reopen them 
> >> as they receive SIGHUP, so chances are that either your syslog 
> >> logged to a file that logrotate or newsyslog or what it's called had 
> >> just deleted, so it got lost at syslogd restart (not that any 
> >> process except debugfs or syslogd could have accessed it), or it has 
> >> logged to newslog.1.gz, after the compressed data (to figure, try 
> >> "tail newslog.1.gz").
> >
> > Nothing was logged after 1 Jul (I posted that info in the first post). The
> > logging just stopped without anything being indicated in any of the
> > logs.
> 
> Then logrotate has first renamed and then gzipped the log file; the
> syslogd operates on a file (rather than a file name) and doesn't notice
> the rename to newslog.1. gzip writes compressed data to a new file,
> newslog.1.gz and deletes newslog.1: syslog logs to the deleted inode
> that used to be known as newslog.1, and as syslog closes the deleted
> file (that contains the log after July 1st), the kernel reclaims the
> disk space and your log data is gone.

Ah ha, that explains a bunch. I was not thinking about the inode issue. 
Hence, my reordering of things so that syslog is restarted after the rotation 
of newslog will do the job (or I could just drop it into logrotate.d/syslog. 
In any event, thank you for the explaination, it clears up a long standing 
bit of confusion.

> Note that zcat doesn't show you plain-text data that got appended to 
> a gzipped file: it just considers it trailing garbage and ignores 
> it. Pipe the file into less to find out.

I had done that, but did not see anything. I suspect that once the inode was 
gone, it just logged into the bit bucket.

Thanks again.

-- 
leafnode-list@xxxxxxxxxxxxxxxxxxxxxxxxxxxx -- mailing list for leafnode
To unsubscribe, send mail with "unsubscribe" in the subject to the list