[SWLUG] Where have all the syslogs gone?
andy at andrewprice.me.uk
Wed Oct 1 09:33:31 UTC 2008
On 01/10/08 10:11, Terry John wrote:
> I'm running a Redhat installation and we had a problem with logfile
> runaway which filled up
> the /var filesystem.
> But I'm clever and I know about filesystems so I created a new one and
> mapped it to /var/log.
> Now your log files can't mess up my MySQL databases I confidently
> declared, but one problem.
> /var/log/messages is no longer being updated. All the other log files
> are working fine but not
> this main syslog file. I'm feeling a little dis-communicated.
At a guess, this is probably because the kernel opens /var/log/messages
before it mounts your new /var/log volume over the original /var/log.
So /var/log/messages should still be there, and getting written to, on
your root partition, just hidden by the new mount.
More information about the Swlug