Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Here is a situation since the log files on my server had grown to several Gigabytes I took a backup of directory /var/log and then manually when to each subdirectory of /var/log and the files which were big in size I did

 cat > /var/log/file_which_is_big

press 2 times enter key (basically over wrote those files with a blank space) and then


So basically I over wrote those files to be blank.

Now when I open /var/log/auth.log I don't see any entry (which is expected also since I over wrote) but when I exit the SSH session and login again then also I do not see any entry in auth.log is there any way other than rebooting the machine to make sure I keep getting the entries in /var/log/auth.log I am not sure which service writes in this file.

This is a Ubuntu 10.04 server.

share|improve this question
up vote 4 down vote accepted
  1. restart rsyslog:

    $sudo service rsyslog restart

  2. Use echo, then not have to restart rsyslog

    $sudo echo -n > /var/log/file_which_is_big

share|improve this answer

On ubuntu 10.04

sudo service syslog-ng restart
share|improve this answer

It is likely that the syslog service writes to this file, as well as a number of others.

Check the file /etc/syslog.conf to see which services are logged to which file (it's not a very complex file, but it should have its own man page if you want some explanation). Provided you're sure that /var/log/auth.log is listed there, and provided you're sure the file exists (sys won't create a file, only append to it) then

/etc/init.d/syslog restart

should ensure that file gets logged to.

Edit: I collided with alvosu's answer above, and I defer to him in picking rsyslog not syslog. I'm a red hat guy, and they're still using syslog.

share|improve this answer
Hi thanks for the reply. – Bond Feb 2 '11 at 4:59

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.