[SWLUG] Where have all the syslogs gone?

[Andrew Price]

Hi Terry,

On 01/10/08 10:11, Terry John wrote:
> I'm running a Redhat installation and we had a problem with logfile
> runaway which filled up
> the /var filesystem.
> 
> But I'm clever and I know about filesystems so I created a new one and
> mapped it to /var/log.
> Now your log files can't mess up my MySQL databases I confidently
> declared, but one problem.
> /var/log/messages is no longer being updated. All the other log files
> are working fine but not
> this main syslog file. I'm feeling a little dis-communicated.

At a guess, this is probably because the kernel opens /var/log/messages 
before it mounts your new /var/log volume over the original /var/log.

So /var/log/messages should still be there, and getting written to, on 
your root partition, just hidden by the new mount.

--
Andy Price