Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Our development team went to start HTTPD and got this:

Starting httpd: (20)Not a directory: httpd: could not open error log file /etc/httpd/logs/error_log.
Unable to open logs
                                                           [FAILED]

Upon investigation we noticed that the logs symlink within /etc/httpd was a file, OK, so resymlinked. Then noticed that the symlink wasn't the right colour: Wrong Colours

So, went to investigate the /var/log/ folder and found something strange... All of the logs are 0 bytes, all changed at the same time yesterday evening, and all of the log folders that should be folders are now 0 byte files too. See below screenshot for comparison with another (almost identical) server: Comparison

Any ideas on what would cause this? It's a virtual machine, and no others have been affected in an even remotely similar way, so I'm not sure that the hardware (which is also new) is failing at this stage.

share|improve this question
    
Did logrotate go nuts? –  Tom O'Connor Jan 17 at 11:25
1  
Looks like a buggy script that has messed the whole thing up ! –  krisFR Jan 17 at 11:28
    
logrotate is running at 04:02, and there are no scripts that are set to run. Even if there were, what would be used to convert a file to a directory other than deleting the dir and touching the file? –  Rudi Visser Jan 17 at 11:33
    
Typically log files that have been removed are either an operator error or a strong indication that a system is compromised. –  HBruijn Jan 17 at 12:03
1  
You may want to consider running a fsck. File system corruption can often make files look like directories or symlinks and other oddities. Be sure to backup or take a snapshot of the VM first. –  jeffatrackaid Jan 17 at 19:11
show 3 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.