On Tuesday 26 June 2007, beast wrote: > > On 26/06/07 13:42 +0100, Seán O Sullivan wrote: > >>>> > >>> I have one centos 4.0 server which /var/log/messages was always >>>> > >>> empty (0 bytes). I wonder what has been blocking the syslog to write >>>> > >>> the log. >>>> >>> > >> >>> > >> Firstly, I'd suggest updating to 4.5. >>> > > > > This is the production machine and has been runing for years, so > > upgrading OS is not not my first option :) > > > >>> > >> Secondly, is /tmp mounted with noexec option? >>> > > > > No afaik. > > > > root# mount | grep var > > /dev/hda4 on /var type ext3 (rw) > > > >> > >forgot to add, check /var/log/messages.* for current syslog messages >> > > > > root# ls -l messages* > > -rw------- 1 root root 0 Jun 25 11:11 messages > > -rw------- 1 root root 32480831 Jun 3 00:04 messages.1.gz > > -rw------- 1 root root 81601061 May 27 00:13 messages.2.gz > > -rw------- 1 root root 905460 May 20 00:01 messages.3.gz > > -rw------- 1 root root 1055604 May 13 00:01 messages.4.gz > > > > Note: previous messages.gz was having gigantic size because recent bug > > in spamassassin, it logs all spampd log thats why I disable it on the > > syslog.conf. But after few days I notice that messages were always > > empty, even I restart syslog and then mv and touch messages > > > >From my own experience there is one trivial way to cause this. How much space is left on whatever partition /var is mounted on? Your comment about SA causing the huge log reminded me of the time I filled /var due to spewage from a bad configuration. Cheers, Dave -- Politics, n. Strife of interests masquerading as a contest of principles. -- Ambrose Bierce