Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm running Ubuntu server 10.04, and my auth.log is no longer getting updated. And actually my auth.log is empty and everything was being logged to auth.log.1, same with syslog, mail, and other logs.

Is that normal for everything to be logged in *.log.1? logrotate had been rotating weekly up until now.

And secondly, any idea why this might be happening? All other logs are fine, and I have the default configs for rsyslog.

share|improve this question

It sounds like logrotate successfully moved /var/log/auth.log to /var/log/auth.log.1 , but did not successfully reload the rsyslog daemon. Therefore, the rsyslog thinks it is still writing to /var/log/auth.log .

If you reload the rsyslog daemon, does it work for you?

A quick manual fix for this is be to restart the rsyslog daemon. rsyslog will then write to the places which are defined in [r]syslog.conf

$ sudo service rsyslog restart
share|improve this answer
i've tried restarting rsyslog but still no luck. i have a cron job running pretty often, it gets logged to syslog just fine and used to log to auth.log, but for some reason it stopped yesterday. – Jico Baligod Apr 20 '11 at 4:30
Well, something is still holding the old auth.log open. Use lsof to see what it is, and make sure it gets restarted in logrotate. – womble Jul 23 '11 at 0:30

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.