System logs are being logged to wrong files

Hi,

Kindly CC me when replying, I am not subscribed. Thanks. Now:

I am using Debian/Sid (sidux actually) on a i686 machine. Over the
past few months, I have seen various logs being logged to the wrong
files, ie, they are being logged to the xyzlog.1 file instead of the
xyzlog files. For example, consider the datestamps & sizes of the
following files (obtained using [1], output edited):

Modification         Change               Size   Filename
2009-10-30 14:59:14  2009-10-30 14:59:14  0     auth.log
2009-10-30 16:43:18  2009-10-30 16:43:18  4901  auth.log.1

2009-10-30 14:59:14  2009-10-30 14:59:14  0     daemon.log
2009-10-30 16:42:28  2009-10-30 16:42:28  4402  daemon.log.1

2009-10-30 15:30:15  2009-10-30 15:30:15  792823        dpkg.log
2009-09-26 01:57:27  2009-10-01 22:10:39  402483        dpkg.log.1

2009-10-30 16:42:50  2009-10-30 16:42:50  2850  kdm.log
2009-10-30 14:59:13  2009-10-30 14:59:13  15126 kdm.log.1

2009-10-30 14:59:14  2009-10-30 14:59:14  0     kern.log
2009-10-30 16:43:06  2009-10-30 16:43:06  66030 kern.log.1

2009-10-30 14:59:14  2009-10-30 14:59:14  0     mail.log
2009-10-30 14:54:23  2009-10-30 14:59:14  158   mail.log.1

2009-10-30 14:59:14  2009-10-30 14:59:14  0     syslog
2009-10-30 16:43:06  2009-10-30 16:43:06  74072 syslog.1

2009-10-30 14:59:14  2009-10-30 14:59:14  0     user.log
2009-10-30 14:54:21  2009-10-30 14:59:14  166   user.log.1

2009-10-30 16:42:28  2009-10-30 16:42:28  15430 Xorg.log
2009-10-19 00:59:08  2009-10-19 00:59:08  16295 Xorg.1.log

As you can see from the size and timestamps:
1. logs for auth, daemon, kern, syslog are sent to the wrong file (*.1)
2. logs for dpkg, kdm, mail, user seems to be OK.
Does anyone know what may be causing such a behavior? I can provide
further information, as needed.
[1] Obtained using:
$ for i in $(ls -1 *log{,.1}); do stat  --printf="%y %z %s\t%n\n" $i;
done | sed 's/\.00*//g;s/[-+][0-9]\{4\}//g'

[2] Digging around the mailing lists, I found the following related
(may not be relevant) threads:
http://lists.debian.org/debian-security/2001/04/msg00041.html
http://episteme.arstechnica.com/groupee/forums/a/tpc/f/96509133/m/755007637731
http://lists.debian.org/debian-user/2006/01/msg03321.html
http://lists.debian.org/debian-devel/2004/02/msg01647.html

--
Regards
PK
--------------------------------------
http://counter.li.org  #402424


--
To UNSUBSCRIBE, email to debian-user-REQUEST@...
with a subject of "unsubscribe". Trouble? Contact listmaster@...

[Jari Fredriksson]

30.10.2009 22:56, P K kirjoitti:

> Hi,
>
> Kindly CC me when replying, I am not subscribed. Thanks. Now:
>
> I am using Debian/Sid (sidux actually) on a i686 machine. Over the
> past few months, I have seen various logs being logged to the wrong
> files, ie, they are being logged to the xyzlog.1 file instead of the
> xyzlog files. For example, consider the datestamps & sizes of the
> following files (obtained using [1], output edited):
>
> Modification         Change               Size   Filename
> 2009-10-30 14:59:14  2009-10-30 14:59:14  0     auth.log
> 2009-10-30 16:43:18  2009-10-30 16:43:18  4901  auth.log.1
>
> As you can see from the size and timestamps:
> 1. logs for auth, daemon, kern, syslog are sent to the wrong file (*.1)
> 2. logs for dpkg, kdm, mail, user seems to be OK.
> Does anyone know what may be causing such a behavior? I can provide
> further information, as needed.

This is just a wild guess, but it seems that your logger is keeping the
files open, and it was not restarted when the logrotate named the logs
again. Seems that the logger had auth.log open, and Linux just keeps
writing to that file (INODE) no matter if the name was changed.

--
http://www.iki.fi/jarif/

Hi,

NOTE: Kindly CC me when replying, I am not subscribed.

I picked up the reply from the list archive.

On Sat, 31 Oct 2009 02:15:19 +0200 Jari Fredriksson wrote:

> 30.10.2009 22:56, P K kirjoitti:
> > Hi,
> >
> > Kindly CC me when replying, I am not subscribed. Thanks. Now:
> >
> > I am using Debian/Sid (sidux actually) on a i686 machine. Over the
> > past few months, I have seen various logs being logged to the wrong
> > files, ie, they are being logged to the xyzlog.1 file instead of the
> > xyzlog files. For example, consider the datestamps & sizes of the
> > following files (obtained using [1], output edited):
> >
> > Modification         Change               Size   Filename
> > 2009-10-30 14:59:14  2009-10-30 14:59:14  0     auth.log
> > 2009-10-30 16:43:18  2009-10-30 16:43:18  4901  auth.log.1
> >
> > As you can see from the size and timestamps:
> > 1. logs for auth, daemon, kern, syslog are sent to the wrong file (*.1)
> > 2. logs for dpkg, kdm, mail, user seems to be OK.
> > Does anyone know what may be causing such a behavior? I can provide
> > further information, as needed.
>
> This is just a wild guess, but it seems that your logger is keeping the
> files open, and it was not restarted when the logrotate named the logs
> again. Seems that the logger had auth.log open, and Linux just keeps
> writing to that file (INODE) no matter if the name was changed.
>

Thanks for the reply.
So, I assume this is not a common problem. Any ways to fix / or
further investigate this?

Thanks,
--
Regards
PK
--------------------------------------
http://counter.li.org  #402424


--
To UNSUBSCRIBE, email to debian-user-REQUEST@...
with a subject of "unsubscribe". Trouble? Contact listmaster@...