Marcelo, I didn't see open file for /var/log/messages. Here is the screen output: ======================================================================== [root at sun ~]# lsof /var/log/* COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME syslogd 2001 root 1w REG 8,6 25323 17653325 /var/log/secure syslogd 2001 root 2w REG 8,6 117544 17653330 /var/log/maillog syslogd 2001 root 3w REG 8,6 13674 17653414 /var/log/cron syslogd 2001 root 4w REG 8,6 0 17653337 /var/log/spooler syslogd 2001 root 5w REG 8,6 0 17653412 /var/log/boot.log syslogd 2001 root 9w REG 8,6 166980 17653308 /var/log/syslog acpid 2418 root 1w REG 8,6 10758 17653423 /var/log/acpid acpid 2418 root 2w REG 8,6 10758 17653423 /var/log/acpid python 3040 root 3w REG 8,6 1187439 17653317 /var/log/denyhosts python 3040 root 5r REG 8,6 25323 17653325 /var/log/secure [root at sun ~]# ps aux | grep syslog root 2001 0.0 0.0 1720 604 ? Ss Feb12 0:00 syslogd -m 0 -r -x root 8249 0.0 0.0 3908 660 pts/0 R+ 07:04 0:00 grep syslog ================================================================================= Frank ________________________________ From: Marcelo Roccasalva <marcelo-centos at irrigacion.gov.ar> To: CentOS mailing list <centos at centos.org> Sent: Friday, February 13, 2009 5:35:51 AM Subject: Re: [CentOS] logs such as messages, boot.log, and kernel contained 0 size On Thu, Feb 12, 2009 at 11:02 PM, Frank Ling <frankling77 at yahoo.com> wrote: > Hi Marcelo, > > Thanks for the comment. I had SELinux disabled. Anyway I tried your trick, > and it didn't work. Something must went wrong. Are the files opened?: # lsof /var/log/* Can you "strace" the [syslog] pid? -- Marcelo "¿No será acaso que ésta vida moderna está teniendo más de moderna que de vida?" (Mafalda) _______________________________________________ CentOS mailing list CentOS at centos.org http://lists.centos.org/mailman/listinfo/centos -------------- next part -------------- An HTML attachment was scrubbed... URL: <http://lists.centos.org/pipermail/centos/attachments/20090213/a7ec86af/attachment-0005.html>