Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Here is a situation since the log files on my server had grown to several Gigabytes I took a backup of directory /var/log and then manually when to each subdirectory of /var/log and the files which were big in size I did

 cat > /var/log/file_which_is_big

press 2 times enter key (basically over wrote those files with a blank space) and then

Ctrl+C

So basically I over wrote those files to be blank.

Now when I open /var/log/auth.log I don't see any entry (which is expected also since I over wrote) but when I exit the SSH session and login again then also I do not see any entry in auth.log is there any way other than rebooting the machine to make sure I keep getting the entries in /var/log/auth.log I am not sure which service writes in this file.

This is a Ubuntu 10.04 server.

share|improve this question

2 Answers 2

up vote 3 down vote accepted
  1. restart rsyslog:

    $sudo service rsyslog restart

  2. Use echo, then not have to restart rsyslog

    $sudo echo -n > /var/log/file_which_is_big

share|improve this answer

It is likely that the syslog service writes to this file, as well as a number of others.

Check the file /etc/syslog.conf to see which services are logged to which file (it's not a very complex file, but it should have its own man page if you want some explanation). Provided you're sure that /var/log/auth.log is listed there, and provided you're sure the file exists (sys won't create a file, only append to it) then

/etc/init.d/syslog restart

should ensure that file gets logged to.

Edit: I collided with alvosu's answer above, and I defer to him in picking rsyslog not syslog. I'm a red hat guy, and they're still using syslog.

share|improve this answer
    
Hi thanks for the reply. –  Bond Feb 2 '11 at 4:59

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.