5

Here is a situation since the log files on my server had grown to several Gigabytes I took a backup of directory /var/log and then manually when to each subdirectory of /var/log and the files which were big in size I did

 cat > /var/log/file_which_is_big

press 2 times enter key (basically over wrote those files with a blank space) and then

Ctrl+C

So basically I over wrote those files to be blank.

Now when I open /var/log/auth.log I don't see any entry (which is expected also since I over wrote) but when I exit the SSH session and login again then also I do not see any entry in auth.log is there any way other than rebooting the machine to make sure I keep getting the entries in /var/log/auth.log I am not sure which service writes in this file.

This is a Ubuntu 10.04 server.

3 Answers 3

8
  1. restart rsyslog:

    $sudo service rsyslog restart

  2. Use echo, then not have to restart rsyslog

    $sudo echo -n > /var/log/file_which_is_big

1

On ubuntu 10.04

sudo service syslog-ng restart
0

It is likely that the syslog service writes to this file, as well as a number of others.

Check the file /etc/syslog.conf to see which services are logged to which file (it's not a very complex file, but it should have its own man page if you want some explanation). Provided you're sure that /var/log/auth.log is listed there, and provided you're sure the file exists (sys won't create a file, only append to it) then

/etc/init.d/syslog restart

should ensure that file gets logged to.

Edit: I collided with alvosu's answer above, and I defer to him in picking rsyslog not syslog. I'm a red hat guy, and they're still using syslog.

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .