[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: rsyslog adding old entries again

Hi Andrei,

So:


root@pf:~# ps aux | grep rsyslog
root     11250  0.8  3.3 872116 274200 ?       Ssl  15:37   2:26 /usr/sbin/rsyslogd -n
root     23873  0.0  0.0  12780   968 pts/0    S+   20:25   0:00 grep rsyslog
root@pf:~# service rsyslog stop
root@pf:~# ps aux | grep rsyslog
root     23909  0.0  0.0  12780  1020 pts/0    S+   20:25   0:00 grep rsyslog



root@pf:~# rm -f /usr/local/pf/logs/*
root@pf9:~# lsof | grep /usr/local/pf/logs
snmptrapd 23941                   root    3w      REG                8,1        23   67605574 /usr/local/pf/logs/snmptrapd.log
and yes: the file snmptrapd.log is the exception, all other files (20, 25 of them) are gone, remain gone, and are not listed in lsof as open.
Then, when starting rsyslog again, this time in debug mode ("rsyslogd -dn") it shows that it IS in fact writing those logs: 


5849.717653159:main Q:Reg/w0  : omfile: write to stream, pData->pStrm 0x7fccf403be50, lenBuf 383, strt data Dec  6 16:22:56 pf9 pfconfig: pfconfig(709) ERROR: [mac:[undef]] Caught error DBI connect('database=pf;host=localhost;port=3306'
5849.717657173:main Q:Reg/w0  : omfile: write to stream, pData->pStrm 0x7fccf403be50, lenBuf 289, strt data Dec  6 16:22:56 pf9 pfconfig: pfconfig(709) ERROR: [mac:[undef]] Couldn't connect to MySQL database to access L2. This is a majo
5849.717661550:main Q:Reg/w0  : omfile: write to stream, pData->pStrm 0x7fccf403be50, lenBuf 99, strt data Dec  6 16:22:56 pf9 pfconfig: Could not write namespace FilterEngine::SwitchScopes() to L2 cache !
5849.717665624:main Q:Reg/w0  : omfile: write to stream, pData->pStrm 0x7fccf403be50, lenBuf 170, strt data Dec  6 16:22:56 pf9 pfconfig: pfconfig(709) ERROR: [mac:[undef]] Could not write namespace FilterEngine::SwitchScopes() to L2 ca
5849.717669576:main Q:Reg/w0  : omfile: write to stream, pData->pStrm 0x7fccf403be50, lenBuf 383, strt data Dec  6 16:22:56 pf9 pfconfig: pfconfig(709) ERROR: [mac:[undef]] Caught error DBI connect('database=pf;host=localhost;port=3306'
5849.717697926:main Q:Reg/w0  : omfile: write to stream, pData->pStrm 0x7fccf403be50, lenBuf 289, strt data Dec  6 16:22:56 pf9 pfconfig: pfconfig(709) ERROR: [mac:[undef]] Couldn't connect to MySQL database to access L2. This is a majo
5849.717702051:main Q:Reg/w0  : omfile: write to stream, pData->pStrm 0x7fccf403be50, lenBuf 383, strt data Dec  6 16:22:56 pf9 pfconfig: pfconfig(709) ERROR: [mac:[undef]] Caught error DBI connect('database=pf;host=localhost;port=3306'


As you can see from the lines above: these are old log lines from Dec 6.
I also see non-packetfence lines, so this is not specific for the packetfence install, sample: 


5860.210336266:main Q:Reg/w0  : omfile: write to stream, pData->pStrm 0x7fcd0c007dd0, lenBuf 95, strt data Dec  6 16:31:31 pf9 kernel: SGI XFS with ACLs, security attributes, realtime, no debug enabled
5860.210339962:main Q:Reg/w0  : omfile: write to stream, pData->pStrm 0x7fcd0c007dd0, lenBuf 63, strt data Dec  6 16:31:31 pf9 kernel: XFS (sda1): Mounting V5 Filesystem
5860.210343827:main Q:Reg/w0  : omfile: write to stream, pData->pStrm 0x7fcd0c007dd0, lenBuf 87, strt data Dec  6 16:31:31 pf9 kernel: usb 1-1: new full-speed USB device number 2 using uhci_hcd
5860.210347393:main Q:Reg/w0  : omfile: write to stream, pData->pStrm 0x7fcd0c007dd0, lenBuf 77, strt data Dec  6 16:31:31 pf9 kernel: XFS (sda1): Starting recovery (logdev: internal)
The date and time on the system is correct. The system has been rebooted repeatedly. 

Anyone who can explain?

MJ
Reply to: