Re: Unexplained freezes and crashes, nothing in /var/log/messages

[Stella Ashburne]

Hi David

> Sent: Friday, June 04, 2021 at 10:27 AM
> From: "David Wright" 
> To: debian-user@lists.debian.org
> Subject: Re: Unexplained freezes and crashes, nothing in /var/log/messages
>
> It's just a home-grown program that's started from .xsession.
> It sets the X background colour in a loop, with excessive
> temperatures taking priority over power indications.
>
Is your program proprietary? If it isn't, would you like to share it with me?

Re: Unexplained freezes and crashes, nothing in /var/log/messages

[David Wright]

On Fri 04 Jun 2021 at 02:05:52 (+0200), Stella Ashburne wrote:
> 
> > Sent: Friday, June 04, 2021 at 5:12 AM
> > From: "David Wright" 
> >
> > My own monitoring program logs the temperature (and battery)
> > every six seconds.
> >
> I'm curious: what's the name of your monitoring program? Is it available for 
> download and installation from Debian's official repos?

It's just a home-grown program that's started from .xsession.
It sets the X background colour in a loop, with excessive
temperatures taking priority over power indications.

It used to be written in shell, but I converted it to python
some years ago when I found that reading the files in
/sys/class/ could fail (3.x kernels). Python's try…except is
easier for me to code than shell's trap mechanism.

I wrote it originally for monitoring whether the AC power
was connected (the brick was unreliable), and the state of
the battery. Temperature came later, for the Dell laptop
I mentioned. That laptop was scrapped last year, and
ironically the Acer laptop it now runs on has a completely
broken power controller (it only runs with AC power).

Woefully underpowered to run even one browser, this Acer
fortunately has a good fan, so it doesn't run too hot. But
it does suffer from symptoms that are somewhat similar to
the OP's—sometimes you have to wait a minute or two (and
avoid touching the touchpad) for things to catch up. But
you can tell it's merely swapping heavily, because the
disk-active light stays lit. (Firefox on buster in ½GB
at 1.5GHz, encrypted /home and 1GB swap.)

Cheers,
David.

Re: Unexplained freezes and crashes, nothing in /var/log/messages

[Stella Ashburne]

Hi David

> Sent: Friday, June 04, 2021 at 5:12 AM
> From: "David Wright" 
> To: debian-user@lists.debian.org
> Subject: Re: Unexplained freezes and crashes, nothing in /var/log/messages
>
>
> My own monitoring program logs the temperature (and battery)
> every six seconds.
>
I'm curious: what's the name of your monitoring program? Is it available for 
download and installation from Debian's official repos?

Stella

Re: Unexplained freezes and crashes, nothing in /var/log/messages

[David Wright]

On Thu 03 Jun 2021 at 18:34:41 (+0100), Tixy wrote:
> On Thu, 2021-06-03 at 12:19 -0400, Polyna-Maude Racicot-Summerside wrote:
> > On 2021-06-03 11:27 a.m., Marc Auslander wrote:
> > > On 6/3/2021 10:20 AM, Ottavio Caruso wrote:
> > > > On 03/06/2021 09:09, Polyna-Maude Racicot-Summerside wrote:
> > > > I check the temperature regularly with sensors and it's usually
> > > > between 42 and 52 C.
> > > > 
> > > > Problem is I can't check the temperature while it's freezing.
> > > > 
> > > > You might run a background job that keeps writing the sensors to a file,
> > > say every 5 minutes, although a really don't know how quickly the
> > > temperature can change.

My own monitoring program logs the temperature (and battery)
every six seconds.

> > > That said, this sounds like a long shot to me.
> > > 
> > Temperature doesn't change in a matter of one or two minutes, unless you
> > have a real heat dissipation problem and you'll see in this case the
> > changes from the time you power it on the temperature will rise fast.
> 
> Only if workload stays the same and the system has reached equilibrium.
> Temperature can change in a matter of seconds if workload suddenly
> changes.
> 
> $ cat /sys/class/thermal/thermal_zone2/type
> x86_pkg_temp
> $ cat /sys/class/thermal/thermal_zone2/temp
> 47000
> $ while : ; do : ; done &
> [1] 4739
> $ cat /sys/class/thermal/thermal_zone2/temp
> 63000
> $ kill 4739
> $ cat /sys/class/thermal/thermal_zone2/temp
> 49000
> 
> That's 15C change in about second on this laptop. My desktop will go
> from drawing 17W from the mains when idle, to 160W when maxing out all
> 8 CPUs and temperature will jump about from 40C to 95C in a few
> seconds. 

I haven't managed that rate of rise on a laptop with two cores,
but it could certainly cook your thighs. The attached shows a profile
when I was running the browser on a weather radar site much of the
day. I don't recall whether the machine was switched off from 16:22
to 16:30, or just not running X, but it was certainly switched off
between 16:53 and 17:18 as I was fetching my wife from work through
flooded streets. (The day reached 29°C whereupon over 4 inches of
rain fell.)

Cheers,
David.

Re: Unexplained freezes and crashes, nothing in /var/log/messages

[Tixy]

On Thu, 2021-06-03 at 12:19 -0400, Polyna-Maude Racicot-Summerside wrote:
> Hi,
> 
> On 2021-06-03 11:27 a.m., Marc Auslander wrote:
> > On 6/3/2021 10:20 AM, Ottavio Caruso wrote:
> > > On 03/06/2021 09:09, Polyna-Maude Racicot-Summerside wrote:
> > > I check the temperature regularly with sensors and it's usually
> > > between 42 and 52 C.
> > > 
> > > Problem is I can't check the temperature while it's freezing.
> > > 
> > > You might run a background job that keeps writing the sensors to a file,
> > say every 5 minutes, although a really don't know how quickly the
> > temperature can change.
> > 
> > That said, this sounds like a long shot to me.
> > 
> Temperature doesn't change in a matter of one or two minutes, unless you
> have a real heat dissipation problem and you'll see in this case the
> changes from the time you power it on the temperature will rise fast.

Only if workload stays the same and the system has reached equilibrium.
Temperature can change in a matter of seconds if workload suddenly
changes.

$ cat /sys/class/thermal/thermal_zone2/type
x86_pkg_temp
$ cat /sys/class/thermal/thermal_zone2/temp
47000
$ while : ; do : ; done &
[1] 4739
$ cat /sys/class/thermal/thermal_zone2/temp
63000
$ kill 4739
$ cat /sys/class/thermal/thermal_zone2/temp
49000

That's 15C change in about second on this laptop. My desktop will go
from drawing 17W from the mains when idle, to 160W when maxing out all
8 CPUs and temperature will jump about from 40C to 95C in a few
seconds. 

-- 
Tixy

Re: Unexplained freezes and crashes, nothing in /var/log/messages

[Polyna-Maude Racicot-Summerside]

Hi,

On 2021-06-03 11:27 a.m., Marc Auslander wrote:
> On 6/3/2021 10:20 AM, Ottavio Caruso wrote:
>> On 03/06/2021 09:09, Polyna-Maude Racicot-Summerside wrote:
>> I check the temperature regularly with sensors and it's usually
>> between 42 and 52 C.
>>
>>
>> Problem is I can't check the temperature while it's freezing.
>>
>>
> You might run a background job that keeps writing the sensors to a file,
> say every 5 minutes, although a really don't know how quickly the
> temperature can change.
> 
> That said, this sounds like a long shot to me.
> 
Temperature doesn't change in a matter of one or two minutes, unless you
have a real heat dissipation problem and you'll see in this case the
changes from the time you power it on the temperature will rise fast.
-- 
Polyna-Maude R.-Summerside
-Be smart, Be wise, Support opensource development



OpenPGP_signature
Description: OpenPGP digital signature

Re: Unexplained freezes and crashes, nothing in /var/log/messages

[Marc Auslander]

On 6/3/2021 10:20 AM, Ottavio Caruso wrote:

On 03/06/2021 09:09, Polyna-Maude Racicot-Summerside wrote:
I check the temperature regularly with sensors and it's usually between 
42 and 52 C.



Problem is I can't check the temperature while it's freezing.


You might run a background job that keeps writing the sensors to a file, 
say every 5 minutes, although a really don't know how quickly the 
temperature can change.


That said, this sounds like a long shot to me.

Re: Unexplained freezes and crashes, nothing in /var/log/messages

[Polyna-Maude Racicot-Summerside]

Hi,

On 2021-06-03 4:17 a.m., Andrei POPESCU wrote:
> On Jo, 03 iun 21, 08:51:06, Ottavio Caruso wrote:
>>
>> $ sudo inxi -FzCDMm
>> System:
>>   Host: e130 Kernel: 4.19.0-8-amd64 x86_64 bits: 64 Desktop: Cinnamon 4.4.8
>>   Distro: LMDE 4 Debbie
> 
> Can you reproduce the issue on Debian?
> 
> Do CapsLock / NumLed or similar LEDs react (provided there are any)?
> 
> Can you ssh into the system, or does it even react to pings from another 
> machine?
> 
>> Drives:
>>   Local Storage: total: 465.76 GiB used: 206.22 GiB (44.3%)
>>   ID-1: /dev/sda vendor: Hitachi model: HTS725050A7E630 size: 465.76 
>>   GiB
> 
> You might want to do a thorough check of the HDD.
> 
> Even if it turns out its ok, provided the rest of the hardware is still 

> good, you should consider replacing the HDD with an SSD. The speed 
> increase will be significant.
> 
> Maxing out the RAM (if any changes are possible) is also a good idea.
> 
Sorry ! But this is irrelevant... When you have a broken piece of
hardware (or faultry), you first find what's not going good before
investing funds into this machine...
You are telling this guy, go out and invest on something that maybe faulty.
So go buys RAM (that may not be easily transferred) for a laptop that
maybe the motherboard is starting to be faulty, like problem with
capacitors or cold solder.

The RAM and HDD are relevant if and only if, what he describe as a
freezes / crashes ain't one but is more of a huge lag with endless waiting.

> Kind regards,
> Andrei
> 

-- 
Polyna-Maude R.-Summerside
-Be smart, Be wise, Support opensource development



OpenPGP_signature
Description: OpenPGP digital signature

Re: Unexplained freezes and crashes, nothing in /var/log/messages

[Andrei POPESCU]

On Jo, 03 iun 21, 08:51:06, Ottavio Caruso wrote:
> 
> $ sudo inxi -FzCDMm
> System:
>   Host: e130 Kernel: 4.19.0-8-amd64 x86_64 bits: 64 Desktop: Cinnamon 4.4.8
>   Distro: LMDE 4 Debbie

Can you reproduce the issue on Debian?

Do CapsLock / NumLed or similar LEDs react (provided there are any)?

Can you ssh into the system, or does it even react to pings from another 
machine?

> Drives:
>   Local Storage: total: 465.76 GiB used: 206.22 GiB (44.3%)
>   ID-1: /dev/sda vendor: Hitachi model: HTS725050A7E630 size: 465.76 
>   GiB

You might want to do a thorough check of the HDD.

Even if it turns out its ok, provided the rest of the hardware is still 
good, you should consider replacing the HDD with an SSD. The speed 
increase will be significant.

Maxing out the RAM (if any changes are possible) is also a good idea.

Kind regards,
Andrei
-- 
http://wiki.debian.org/FAQsFromDebianUser


signature.asc
Description: PGP signature

Re: Unexplained freezes and crashes, nothing in /var/log/messages

[Polyna-Maude Racicot-Summerside]

When you say "it freeze".
How long have you waited before "pulling the plug" or considering other
way of powering off ?

Have you checked the temperature of your CPU after leaving it running
for a while. Laptop end up with lot of dirt inside and this is not good
for thermal conductivity. So they tend to heat up when they get older
(and not cleaned).

If your system freeze it may be some problem caused by overheating. On
the long run, capacitor get tricky and solder may become problematic.

But first, is this happening only when you have been using the system
for a while ? Because this could point to a problem of overheating.

What are asking here anyway is pretty tough. As we don't have your
hardware in front of us.

On 2021-06-03 3:51 a.m., Ottavio Caruso wrote:
> On 03/06/2021 08:04, Andrei POPESCU wrote:
>> On Jo, 03 iun 21, 07:49:32, Ottavio Caruso wrote:
>>> Debian Buster here. My laptop is aging and has only 4BG Ram, however
>>> that
>>> should be sufficient for a couple of instances of Firefox (no streaming,
>>> etc) and an instance of Chromium.
>>>
>>> It has happened a few times in the last few days that the system becomes
>>> irresponsive, the screen is frozen, I can't shut X down nor go into text
>>> mode. I can't hear any drive activity.
>>
>> Does this imply all drives are rotating?
>>
>> Anyway, more information on the hardware might help.
> 
> 
> $ sudo inxi -FzCDMm
> System:
>  Host: e130 Kernel: 4.19.0-8-amd64 x86_64 bits: 64 Desktop: Cinnamon 4.4.8
>  Distro: LMDE 4 Debbie
> Machine:
>  Type: Laptop System: LENOVO product: 33588QG v: ThinkPad Edge E130
>  serial: 
>  Mobo: LENOVO model: 33588QG v: Win8 Pro DPK TPG serial: 
>  UEFI: LENOVO v: H4ET98WW (2.58 ) date: 08/24/2016
> Battery:
>  ID-1: BAT1 charge: 45.1 Wh condition: 58.2/62.2 Wh (94%)
> Memory:
>  RAM: total: 3.70 GiB used: 1.77 GiB (47.7%)
>  Array-1: capacity: 16 GiB slots: 2 EC: None
>  Device-1: ChannelA-DIMM0 size: 2 GiB speed: 1067 MT/s
>  Device-2: ChannelB-DIMM0 size: 2 GiB speed: 1067 MT/s
> CPU:
>  Topology: Dual Core model: Intel Core i3-3217U bits: 64 type: MT MCP
>  L2 cache: 3072 KiB
>  Speed: 951 MHz min/max: 800/1800 MHz Core speeds (MHz): 1: 1229 2: 997
>  3: 1139 4: 1385
> Graphics:
>  Device-1: Intel 3rd Gen Core processor Graphics driver: i915 v: kernel
>  Display: server: X.Org 1.20.4 driver: modesetting unloaded: fbdev,vesa
>  resolution: 1366x768~60Hz
>  OpenGL: renderer: Mesa DRI Intel Ivybridge Mobile v: 4.2 Mesa 18.3.6
> Audio:
>  Device-1: Intel 7 Series/C216 Family High Definition Audio
>  driver: snd_hda_intel
>  Sound Server: ALSA v: k4.19.0-8-amd64
> Network:
>  Device-1: Intel Centrino Wireless-N 2230 driver: iwlwifi
>  IF: wlp3s0 state: up mac: 
>  Device-2: Realtek RTL8111/8168/8411 PCI Express Gigabit Ethernet
>  driver: r8169
>  IF: enp9s0 state: down mac: 
>  Device-3: Ericsson Business Mobile Networks BV H5321 gw Mobile Broadband
>  Driver
>  type: USB driver: cdc_acm,cdc_ncm,cdc_wdm
>  IF: wwp0s29u1u6i6 state: down mac: 
> Drives:
>  Local Storage: total: 465.76 GiB used: 206.22 GiB (44.3%)
>  ID-1: /dev/sda vendor: Hitachi model: HTS725050A7E630 size: 465.76 GiB
> Partition:
>  ID-1: / size: 47.81 GiB used: 13.96 GiB (29.2%) fs: ext4 dev: /dev/sda5
>  ID-2: /home size: 46.45 GiB used: 24.20 GiB (52.1%) fs: ext4
>  dev: /dev/sda8
>  ID-3: swap-1 size: 8.08 GiB used: 245.6 MiB (3.0%) fs: swap dev: /dev/sda7
> Sensors:
>  System Temperatures: cpu: 53.0 C mobo: 0.0 C
>  Fan Speeds (RPM): cpu: 600
> Info:
>  Processes: 200 Uptime: 1d 10h 29m Shell: bash inxi: 3.0.32
> 
> 
> 

-- 
Polyna-Maude R.-Summerside
-Be smart, Be wise, Support opensource development



OpenPGP_signature
Description: OpenPGP digital signature

Re: Unexplained freezes and crashes, nothing in /var/log/messages

[Andrei POPESCU]

On Jo, 03 iun 21, 07:49:32, Ottavio Caruso wrote:
> Debian Buster here. My laptop is aging and has only 4BG Ram, however that
> should be sufficient for a couple of instances of Firefox (no streaming,
> etc) and an instance of Chromium.
> 
> It has happened a few times in the last few days that the system becomes
> irresponsive, the screen is frozen, I can't shut X down nor go into text
> mode. I can't hear any drive activity. 

Does this imply all drives are rotating?

Anyway, more information on the hardware might help.

Kind regards,
Andrei
-- 
http://wiki.debian.org/FAQsFromDebianUser


signature.asc
Description: PGP signature

Re: Unexplained freezes and crashes, nothing in /var/log/messages

[Gene Heskett]

On Thursday 03 June 2021 02:49:32 Ottavio Caruso wrote:

> Debian Buster here. My laptop is aging and has only 4BG Ram, however
> that should be sufficient for a couple of instances of Firefox (no
> streaming, etc) and an instance of Chromium.
>
> It has happened a few times in the last few days that the system
> becomes irresponsive, the screen is frozen, I can't shut X down nor go
> into text mode. I can't hear any drive activity. The only way out is
> to shut the laptop from the power button and reboot. I then check in
> /var/log/messages and there is absolutely nothing that can give me any
> hint.
>
> I thought I knew how to troubleshoot a crash but it appears I don't.
>
> Lenovo diagnostic tools can't find anything wrong.
>
> The only possible culprit is maybe tlp [1]? Maybe there is something
> in power management that makes the laptop freeze? Or maybe the RAM is
> gone/going and the diagnostic tools are not picking it up?
>
Have you run memtest86 ?, that might be informative.
>
> [1] https://linrunner.de/tlp/


Cheers, Gene Heskett
-- 
"There are four boxes to be used in defense of liberty:
 soap, ballot, jury, and ammo. Please use in that order."
-Ed Howdershelt (Author)
If we desire respect for the law, we must first make the law respectable.
 - Louis D. Brandeis
Genes Web page <http://geneslinuxbox.net:6309/gene>

Re: gpm dumping info to /var/log/messages

[Kailash Kalyani]

On Wednesday 08 January 2014 01:17 PM, Mike McClain wrote:

Is there any way to stop gpm from dumping to /var/log/messages every
time I copy/paste without stopping other deamons from writing info
there too? I see no such provisions in the man pages.
Thanks,
Mike
--
Who knows what evil lurks in the hearts of men?



Hi Mike,

You should look at the manpage and documentation of rsyslog.conf

if you want to discard messages from gpm you could add a line in the 
RULES section which goes

#this discards all messages from gpm
gpm.*   ~

HTH,
Kailash


--
To UNSUBSCRIBE, email to debian-user-requ...@lists.debian.org 
with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org

Archive: http://lists.debian.org/52d397a5.5080...@gmail.com

gpm dumping info to /var/log/messages

[Mike McClain]

Is there any way to stop gpm from dumping to /var/log/messages every
time I copy/paste without stopping other deamons from writing info
there too? I see no such provisions in the man pages.
Thanks,
Mike
--
Who knows what evil lurks in the hearts of men?


-- 
To UNSUBSCRIBE, email to debian-user-requ...@lists.debian.org 
with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
Archive: http://lists.debian.org/20140108074721.GA3876@playground

Re: Strange occurrence in /var/log/messages

[Claudius Hubig]

Spiros Bousbouras  wrote:
>Jul  1 07:35:01 home kernel: imklog 3.18.6, log source = /proc/kmsg started.
>Jul  1 07:35:01 home rsyslogd: [origin software="rsyslogd"
>swVersion="3.18.6" x-pid="2103" x-info="http://www.rsyslog.com";]
>restart
>Jul  1 07:35:01 home kernel: imklog 3.18.6, log source = /proc/kmsg started.
>Jul  1 07:35:01 home rsyslogd: [origin software="rsyslogd"
>swVersion="3.18.6" x-pid="2103" x-info="http://www.rsyslog.com";]
>restart
>
>(Some wraparound may have occurred in the above)
>
>The same pair of messages is repeated. First time I notice such a
>thing. In /var/log/kern.log I see at the bottom
>
>Jul  1 07:35:01 home kernel: imklog 3.18.6, log source = /proc/kmsg started.
>Jul  1 07:35:01 home kernel: imklog 3.18.6, log source = /proc/kmsg started.
>
>Once again a duplication.
>
>Is there any legitimate reason this might have happened or is it a
>kernel bug ? Neither file has anything else I haven't seen before.

How many instances of rsyslog or comparable daemons are running on
your system? Do you use logrotate or something similiar that restarts
logging daemons? Check crontab -l and /etc/crontab for the tasks that
usually run at 07:35, and then check either these tasks, or, if it is
something like cron-daily, check /etc/cron.daily. 

If you indeed use logrotate, check /etc/logrotate.d
and /etc/logrotate.conf if you have two lines saying that rsyslog
should be restarted (maybe grep for rsyslog in the above-mentioned
directories).

Best regards,

Claudius
-- 
New systems generate new problems.
Please use GPG: ECB0C2C7 4A4C4046 446ADF86 C08112E5 D72CDBA4
http://chubig.net/ http://nightfall.org



-- 
To UNSUBSCRIBE, email to debian-user-requ...@lists.debian.org 
with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
Archive: http://lists.debian.org/20110701193551.13845...@ares.home.chubig.net

Re: Strange occurrence in /var/log/messages

[Camaleón]

On Fri, 01 Jul 2011 17:38:08 +0100, Spiros Bousbouras wrote:

> [Please preserve the CC]

Sorry but I can't.

> At the bottom of /var/log/messages I see
> 
> Jul  1 07:35:01 home kernel: imklog 3.18.6, log source = /proc/kmsg started. 
> Jul  1 07:35:01 home rsyslogd: [origin software="rsyslogd" swVersion="3.18.6" 
> x-pid="2103" x-info="http://www.rsyslog.com";] restart
> Jul  1 07:35:01 home kernel: imklog 3.18.6, log source = /proc/kmsg started. 
> Jul  1 07:35:01 home rsyslogd: [origin software="rsyslogd" swVersion="3.18.6" 
> x-pid="2103" x-info="http://www.rsyslog.com";] restart

(...)

> The same pair of messages is repeated. First time I notice such a thing.
> In /var/log/kern.log I see at the bottom
> 
> Jul  1 07:35:01 home kernel: imklog 3.18.6, log source = /proc/kmsg
> started. Jul  1 07:35:01 home kernel: imklog 3.18.6, log source =
> /proc/kmsg started.
> 
> Once again a duplication.

JFYI, I also get them:

stt008:~# grep -i -e imk -e rsyslog /var/log/syslog*
/var/log/syslog:Jul  1 07:52:00 stt008 kernel: imklog 3.18.6, log source = 
/proc/kmsg started.
/var/log/syslog:Jul  1 07:52:00 stt008 rsyslogd: [origin software="rsyslogd" 
swVersion="3.18.6" x-pid="2616" x-info="http://www.rsyslog.com";] restart
/var/log/syslog.1:Jul  1 07:38:58 stt008 kernel: imklog 3.18.6, log source = 
/proc/kmsg started.
/var/log/syslog.1:Jul  1 07:38:58 stt008 rsyslogd: [origin software="rsyslogd" 
swVersion="3.18.6" x-pid="2616" x-info="http://www.rsyslog.com";] restart

> Is there any legitimate reason this might have happened or is it a
> kernel bug ? Neither file has anything else I haven't seen before.

Dunno, but I hope yes, there should be a good reason for starting rsyslog 
service and imklog module twice.

Greetings,

-- 
Camaleón


-- 
To UNSUBSCRIBE, email to debian-user-requ...@lists.debian.org 
with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
Archive: http://lists.debian.org/pan.2011.07.01.17.28...@gmail.com

Strange occurrence in /var/log/messages

[Spiros Bousbouras]

[Please preserve the CC]

Apologies for the duplication , I forgot to include a
subject in the previous message.

At the bottom of /var/log/messages I see

Jul  1 07:35:01 home kernel: imklog 3.18.6, log source = /proc/kmsg started.
Jul  1 07:35:01 home rsyslogd: [origin software="rsyslogd"
swVersion="3.18.6" x-pid="2103" x-info="http://www.rsyslog.com";]
restart
Jul  1 07:35:01 home kernel: imklog 3.18.6, log source = /proc/kmsg started.
Jul  1 07:35:01 home rsyslogd: [origin software="rsyslogd"
swVersion="3.18.6" x-pid="2103" x-info="http://www.rsyslog.com";]
restart

(Some wraparound may have occurred in the above)

The same pair of messages is repeated. First time I notice such a
thing. In /var/log/kern.log I see at the bottom

Jul  1 07:35:01 home kernel: imklog 3.18.6, log source = /proc/kmsg started.
Jul  1 07:35:01 home kernel: imklog 3.18.6, log source = /proc/kmsg started.

Once again a duplication.

Is there any legitimate reason this might have happened or is it a
kernel bug ? Neither file has anything else I haven't seen before.


-- 
To UNSUBSCRIBE, email to debian-user-requ...@lists.debian.org 
with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
Archive: 
http://lists.debian.org/BANLkTikSv=eu3jtpnxzqpq9obfpkwed...@mail.gmail.com

Re: /var/log/messages(dmesg) ?

[Andrew M.A. Cater]

On Tue, Feb 23, 2010 at 07:10:45AM -0500, Stephen Powell wrote:
> On Mon, 22 Feb 2010 23:58:47 -0500 (EST), Hadi Motamedi wrote:
> > On Mon, 22 Feb 2010 10:00:57 -0500, Stephen Powell wrote:
> >> On Mon, 22 Feb 2010 05:41:04 -0500 (EST), Hadi Motamedi wrote:
> >>> My Debian server got hung and when I tried to power cycle it,
> >>> I checked its /var/log/messages & /var/log/dmesg with respect to the time
> >>> of fault occurance to see what was really happened. But its 'messages'
> >>> log does not show anything recorded for about 30 minutes before its
> >>> recovery after power cycling. Can you please let me know where is I can
> >>> check to find the root cause of failure?
> >> 
> >> You might try /var/log/syslog.
> > 
> > Thank you.  It contains a lot of info.  Please let me to ask you if
> > I can have it on my Red Hat server as well?  Is it just dedicated to
> > Debian, as my Red Hat server does not contain /var/log/syslog?
> 
> Red Hat is not supported on this list.  And I don't know the answer.
> There is probably something equivalent in Red Hat, or at least it is
> possible to get the equivalent.  But please don't ask Red Hat support
> questions on a Debian forum.
> 

On a Centos 5.4 machine: look at /etc/syslog.conf which will tell you 
what's logged where.

By default, Red Hat appears to break up its logs into many more files.

This list is primarily for Debian, though some of us who also use Red Hat 
may occasionally offer assistance to people moving across to and unfamiliar 
with Debian. 

As suggested from time to time, please learn to ask smart questions -
[http://catb.org/~esr/faqs/smart-questions.html]

For further and better support for Red Hat machines:

If you have a current Red Hat subscription, contact Red Hat.

If you don't have a current Red Hat subscription for support, pay for 
one and they will provide you with paid for support. That's what they're 
there for and why they train, pay for and provide staff dedicated to 
supporting their product.

If you can't obtain/afford support from Red Hat, convert your 
machines to running the equivalent CentOS release and monitor the CentOS 
support lists, wikis and other support resources yourself. 
[www.centos.org should provide a good start.]

This list and others like it served from debian.org will provide you 
with ready support for Debian but we can't, unfortunately, provide 
assistance for every Linux query for every Linux flavour, though we may 
endeavour to try where the questioner has already exhausted primary 
resources. The clue to the majority of our expertise does lie in the 
mailing list name :)

Oh, and, in case you didn't already know GIYF - Google is your friend - 
here.

Query: "syslog file location in Red Hat Linux" 

Answer: 5. Quick HOWTO - Troubleshooting Linux with Syslog - would 
probably have given you the answer here.

All the best

AndyC

> 
> -- 
> To UNSUBSCRIBE, email to debian-user-requ...@lists.debian.org 
> with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
> Archive: 
> http://lists.debian.org/2104689238.14410681266927045713.javamail.r...@md01.wow.synacor.com


-- 
To UNSUBSCRIBE, email to debian-user-requ...@lists.debian.org 
with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
Archive: http://lists.debian.org/20100223212721.ga17...@galactic.demon.co.uk

RE: /var/log/messages(dmesg) ?

[Stephen Powell]

On Mon, 22 Feb 2010 23:58:47 -0500 (EST), Hadi Motamedi wrote:
> On Mon, 22 Feb 2010 10:00:57 -0500, Stephen Powell wrote:
>> On Mon, 22 Feb 2010 05:41:04 -0500 (EST), Hadi Motamedi wrote:
>>> My Debian server got hung and when I tried to power cycle it,
>>> I checked its /var/log/messages & /var/log/dmesg with respect to the time
>>> of fault occurance to see what was really happened. But its 'messages'
>>> log does not show anything recorded for about 30 minutes before its
>>> recovery after power cycling. Can you please let me know where is I can
>>> check to find the root cause of failure?
>> 
>> You might try /var/log/syslog.
> 
> Thank you.  It contains a lot of info.  Please let me to ask you if
> I can have it on my Red Hat server as well?  Is it just dedicated to
> Debian, as my Red Hat server does not contain /var/log/syslog?

Red Hat is not supported on this list.  And I don't know the answer.
There is probably something equivalent in Red Hat, or at least it is
possible to get the equivalent.  But please don't ask Red Hat support
questions on a Debian forum.


-- 
To UNSUBSCRIBE, email to debian-user-requ...@lists.debian.org 
with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
Archive: 
http://lists.debian.org/2104689238.14410681266927045713.javamail.r...@md01.wow.synacor.com

RE: /var/log/messages(dmesg) ?

[Hadi Motamedi]

 

> Date: Mon, 22 Feb 2010 10:00:57 -0500
> From: zlinux...@wowway.com
> To: debian-user@lists.debian.org
> Subject: Re: /var/log/messages(dmesg) ?
> 
> On Mon, 22 Feb 2010 05:41:04 -0500 (EST), Hadi Motamedi wrote:
> +1+2+3+4+5+6+7+8
> > My Debian server got hung and when I tried to power cycle it,
> > I checked its /var/log/messages & /var/log/dmesg with respect to the time
> > of fault occurance to see what was really happened. But its 'messages'
> > log does not show anything recorded for about 30 minutes before its
> > recovery after power cycling. Can you please let me know where is I can
> > check to find the root cause of failure?
> 
> You might try /var/log/syslog.
> 
> 
> -- 
> To UNSUBSCRIBE, email to debian-user-requ...@lists.debian.org 
> with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
> Archive: 
> http://lists.debian.org/1471035642.14152961266850857251.javamail.r...@md01.wow.synacor.com
> 

Thank you . It contains a lot of info . Please let me to ask you if I can have 
it on my Red Hat server as well ? Is it just dedicated to Debian , as my Red 
Hat server does not contain /var/log/syslog ?


 
  
_
Hotmail: Free, trusted and rich email service.
https://signup.live.com/signup.aspx?id=60969

Re: /var/log/messages(dmesg) ?

[ceduardo]

2010/2/22 Hadi Motamedi :
> Dear All
> My Debian server got hung and when I tried to power cycle it , I checked its

Can you try to explain the syntoms? and What services do you have into
the server?

One day on some one the my Servers turned off the services and I was
seeing all logs and can´t see nothing but with top common, I see that
my Swap partition was very small and the resources it was full.

I Fixed the problem Swap partition, the machinge was runing without problems.

> /var/log/messages & /var/log/dmesg with respect to the time of fault
> occurance to see what was really happened . But its 'messages' log does not
> show anything recorded for about 30 minutes before its recovery after power
> cycling . Can you please let me know where is I can check to find the root
> cause of failure ?
> Thank you
>
>

> 
> Hotmail: Trusted email with powerful SPAM protection. Sign up now.



-- 
ceduardo


--
To UNSUBSCRIBE, email to debian-user-requ...@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
Archive: 
http://lists.debian.org/c068e3701002220810x7d63126cm197879fde4c65...@mail.gmail.com

Re: /var/log/messages(dmesg) ?

[Jon Dowland]

On Mon, Feb 22, 2010 at 11:46:35AM +, Hadi Motamedi
wrote:
> Thanks for your reply . I added the kern.log to my
> /etc/syslog.conf as the following :
> 
> kern.*  /var/log/kern.log

I'm suprised it wasn't there already!

> I will check my /var/log/kern.log on my Debian server next
> hung state .

Make sure you restart your syslog daemon so that your
changes take effect.


signature.asc
Description: Digital signature

Re: /var/log/messages(dmesg) ?

[Stephen Powell]

On Mon, 22 Feb 2010 05:41:04 -0500 (EST), Hadi Motamedi wrote:
+1+2+3+4+5+6+7+8
> My Debian server got hung and when I tried to power cycle it,
> I checked its /var/log/messages & /var/log/dmesg with respect to the time
> of fault occurance to see what was really happened.  But its 'messages'
> log does not show anything recorded for about 30 minutes before its
> recovery after power cycling.  Can you please let me know where is I can
> check to find the root cause of failure?

You might try /var/log/syslog.


-- 
To UNSUBSCRIBE, email to debian-user-requ...@lists.debian.org 
with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
Archive: 
http://lists.debian.org/1471035642.14152961266850857251.javamail.r...@md01.wow.synacor.com

RE: /var/log/messages(dmesg) ?

[Hadi Motamedi]

 

> Date: Mon, 22 Feb 2010 11:21:01 +
> From: j...@debian.org
> To: debian-user@lists.debian.org
> Subject: Re: /var/log/messages(dmesg) ?
> 
> On Mon, Feb 22, 2010 at 10:41:04AM +, Hadi Motamedi
> wrote:
> > My Debian server got hung and when I tried to power cycle
> > it , I checked its /var/log/messages & /var/log/dmesg with
> > respect to the time of fault occurance to see what was
> > really happened . But its 'messages' log does not show
> > anything recorded for about 30 minutes before its recovery
> > after power cycling . Can you please let me know where is
> > I can check to find the root cause of failure ?
> 
> Well, whether or not the root cause would be logged depends
> on a lot of factors, but you might find /var/log/kern.log
> useful in a lot of situations.
> 
> See /etc/syslog.conf (or /etc/rsyslog.conf if you are using
> rsyslog) to see what types of syslog messages get logged to
> what files.

 

Thanks for your reply . I added the kern.log to my /etc/syslog.conf as the 
following :

kern.*  /var/log/kern.log

I will check my /var/log/kern.log on my Debian server next hung state .


 
  
_
Hotmail: Trusted email with powerful SPAM protection.
https://signup.live.com/signup.aspx?id=60969

Re: /var/log/messages(dmesg) ?

[Jon Dowland]

On Mon, Feb 22, 2010 at 10:41:04AM +, Hadi Motamedi
wrote:
> My Debian server got hung and when I tried to power cycle
> it , I checked its /var/log/messages & /var/log/dmesg with
> respect to the time of fault occurance to see what was
> really happened . But its 'messages' log does not show
> anything recorded for about 30 minutes before its recovery
> after power cycling . Can you please let me know where is
> I can check to find the root cause of failure ?

Well, whether or not the root cause would be logged depends
on a lot of factors, but you might find /var/log/kern.log
useful in a lot of situations.

See /etc/syslog.conf (or /etc/rsyslog.conf if you are using
rsyslog) to see what types of syslog messages get logged to
what files.


signature.asc
Description: Digital signature

/var/log/messages(dmesg) ?

[Hadi Motamedi]

Dear All

My Debian server got hung and when I tried to power cycle it , I checked its 
/var/log/messages & /var/log/dmesg with respect to the time of fault occurance 
to see what was really happened . But its 'messages' log does not show anything 
recorded for about 30 minutes before its recovery after power cycling . Can you 
please let me know where is I can check to find the root cause of failure ?

Thank you

 
  
_
Hotmail: Trusted email with powerful SPAM protection.
https://signup.live.com/signup.aspx?id=60969

Re: Re: gconfd errors in /var/log/messages

[Manuel Roberto Callado Palomo]

Oficina de Cooperación Universitaria
Área de Servicios Técnicos
Arequipa, 1. Pl. 5 28043 Madrid
Tel: +34 - 902.11.21.40 (ext. 422 / 552)
e-mail: [EMAIL PROTECTED]  
http://www.ocu.es  
-
Antes de imprimir este mensaje, asegúrate de que es necesario. Proteger el 
medio ambiente está también en tu mano.

Re: watch my /var/log/messages log !

[Edward Shornock]

On Thu, Dec 01, 2005 at 11:19:31PM +0100, Zouari Fourat wrote:
> Hello,
> When doing tail -f /var/log/messages i get an unlimited number of
> lines like this :
> 
> Dec  1 23:12:49 fourat kernel: codec_write 1: semaphore is not ready
> for register 0x54
> Dec  1 23:12:49 fourat kernel: codec_semaphore: semaphore is not ready
> [0x1][0x700304]
> Dec  1 23:12:49 fourat kernel: codec_write 1: semaphore is not ready
> for register 0x54
> Dec  1 23:12:49 fourat kernel: codec_semaphore: semaphore is not ready
> [0x1][0x700300]
> Dec  1 23:12:49 fourat kernel: codec_write 1: semaphore is not ready
> for register 0x54
> Dec  1 23:12:49 fourat kernel: codec_semaphore: semaphore is not ready
> [0x1][0x700300]
> Dec  1 23:12:49 fourat kernel: codec_write 1: semaphore is not ready
> for register 0x54
> 
> 
> and it's adding those lines every second ! this is an old issue on my
> Sarge 3.1, what's the problem ?
> it's affecting my system's speed.
> 

See if this thread might help you:

http://lkml.org/lkml/2005/6/20/69


signature.asc
Description: Digital signature

watch my /var/log/messages log !

[Zouari Fourat]

Hello,
When doing tail -f /var/log/messages i get an unlimited number of
lines like this :

Dec  1 23:12:49 fourat kernel: codec_write 1: semaphore is not ready
for register 0x54
Dec  1 23:12:49 fourat kernel: codec_semaphore: semaphore is not ready
[0x1][0x700304]
Dec  1 23:12:49 fourat kernel: codec_write 1: semaphore is not ready
for register 0x54
Dec  1 23:12:49 fourat kernel: codec_semaphore: semaphore is not ready
[0x1][0x700300]
Dec  1 23:12:49 fourat kernel: codec_write 1: semaphore is not ready
for register 0x54
Dec  1 23:12:49 fourat kernel: codec_semaphore: semaphore is not ready
[0x1][0x700300]
Dec  1 23:12:49 fourat kernel: codec_write 1: semaphore is not ready
for register 0x54


and it's adding those lines every second ! this is an old issue on my
Sarge 3.1, what's the problem ?
it's affecting my system's speed.

Re: gconfd errors in /var/log/messages

[kamaraju kusumanchi]

kamaraju kusumanchi wrote:

Sep  1 14:18:30 localhost gconfd (raju-7859): Resolved address 
"xml:readonly:/etc/gconf/gconf.xml.mandatory" to a read-only 
configuration source at position 0
Sep  1 14:18:30 localhost gconfd (raju-7859): Resolved address 
"xml:readwrite:/home/rajulocal/.gconf" to a writable configuration 
source at position 1
Sep  1 14:18:30 localhost gconfd (raju-7859): Resolved address 
"xml:readonly:/etc/gconf/gconf.xml.defaults" to a read-only 
configuration source at position 2



My /var/log/messages are full of errors such as above. I am using 
unstable. Normally I use kde but gnome is also installed on this 
machine. I checked in the BTS againts gconf and could not find any 
bugs listed. What should I do to get rid of these errors?


raju

Never mind. This bug has been reported against gconf2 and I searched 
only against gconf before posting my previous message.


http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=188433
http://bugzilla.gnome.org/show_bug.cgi?id=126468

But it is sad that the upstream did not fix this bug even after 2.5 years.

raju

--
Kamaraju S Kusumanchi
Graduate Student, MAE
Cornell University
http://www.people.cornell.edu/pages/kk288/


--
To UNSUBSCRIBE, email to [EMAIL PROTECTED] 
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

gconfd errors in /var/log/messages

[kamaraju kusumanchi]

Sep  1 14:18:30 localhost gconfd (raju-7859): Resolved address 
"xml:readonly:/etc/gconf/gconf.xml.mandatory" to a read-only 
configuration source at position 0
Sep  1 14:18:30 localhost gconfd (raju-7859): Resolved address 
"xml:readwrite:/home/rajulocal/.gconf" to a writable configuration 
source at position 1
Sep  1 14:18:30 localhost gconfd (raju-7859): Resolved address 
"xml:readonly:/etc/gconf/gconf.xml.defaults" to a read-only 
configuration source at position 2



My /var/log/messages are full of errors such as above. I am using 
unstable. Normally I use kde but gnome is also installed on this 
machine. I checked in the BTS againts gconf and could not find any bugs 
listed. What should I do to get rid of these errors?


raju

--
Kamaraju S Kusumanchi
Graduate Student, MAE
Cornell University
http://www.people.cornell.edu/pages/kk288/


--
To UNSUBSCRIBE, email to [EMAIL PROTECTED] 
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Re: /var/log/messages entry??

[Kevin Mark]

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

On Wed, Aug 18, 2004 at 02:40:52PM -0400, Ishwar Rattan wrote:
> System is Kanotix-BH-07A (Sid based).
> 
> I see entries of the form (in /var/log/messages):
> 
> Aug 18 13:54:45 Hostname -- MARK --
> Aug 18 14:14:45 Hostname -- MARK --
> 
> with a frequency of 20 minutes. What is the the
> significance of such entries?
> 
> -ishwar
> 
Hi ishwar, 
the logging daemon, like most, was setup to say 'i'm still running' in
this way. It makes reading the log easy so that you can tell how much
time has passed.
- --Kev
- -- 

(__)
(oo)
  /--\/
 / |||
*  /\---/\
   ~~   ~~
"Have you mooed today?"...
-BEGIN PGP SIGNATURE-
Version: GnuPG v1.2.5 (GNU/Linux)

iD8DBQFBJFUFAWAAuqdWA9cRAnLsAJ9DngfCllzCL2BLEzJTRf67R0p25QCfe+hm
jGFnMAjB8eoMsK5/0Ff5x+g=
=JiY5
-END PGP SIGNATURE-


-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED] 
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Re: /var/log/messages entry??

[Shot]

Hello.

Ishwar Rattan:

> I see entries of the form (in /var/log/messages):
> 
> Aug 18 13:54:45 Hostname -- MARK --
> Aug 18 14:14:45 Hostname -- MARK --
> 
> with a frequency of 20 minutes. What
> is the significance of such entries?

It means nothing worth logging happened during these 20 minutes.
Syslog adds these lines to let you know it's working fine (otherwise
you could suspect the lack of messages means syslog is somehow broken).

Cheers,
-- Shot
-- 
  I can't go on meeting you like this.
  ~~~ TeX ~~~

 http://shot.pl/hovercraft/


-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED] 
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Re: /var/log/messages entry??

[Thomas Adam]

On Wed, Aug 18, 2004 at 02:40:52PM -0400, Ishwar Rattan wrote:
> System is Kanotix-BH-07A (Sid based).
> 
> I see entries of the form (in /var/log/messages):
> 
> Aug 18 13:54:45 Hostname -- MARK --
> Aug 18 14:14:45 Hostname -- MARK --
> 
> with a frequency of 20 minutes. What is the the
> significance of such entries?

This is described in "man syslog" oddly enough, and all it means is
that syslog is still running and monitoring. It's useful if you find
a long delay in your logs, and want to ensure syslog is still alive.
It cam be turned off. See the man page.

-- Thomas Adam
--
"Frankly, Mr. Shankly, since you ask. You are a flatulent pain in 
the arse." -- Morrissey.


-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED] 
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

/var/log/messages entry??

[Ishwar Rattan]

System is Kanotix-BH-07A (Sid based).

I see entries of the form (in /var/log/messages):

Aug 18 13:54:45 Hostname -- MARK --
Aug 18 14:14:45 Hostname -- MARK --

with a frequency of 20 minutes. What is the the
significance of such entries?

-ishwar


-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED] 
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Re: repeated entries in /var/log/messages...

[John Summerfield]

Mario Flores wrote:
Hi:
Since day 1 I installed debian, I see the following in the 
/var/log/messages:

Jul 28 21:01:08 woody -- MARK --
Jul 28 21:21:08 woody -- MARK --
Jul 28 21:41:08 woody -- MARK --
and they repeat every single hour at the exact same intervals. Does 
anyone know what they mean and how can I stop them?

After a crash, you can refer to the logs and say, "Well it was still 
running at 22:00, so the lights went out after that."

I'd rather have it more often rather than less.
--
Cheers
John
-- spambait
[EMAIL PROTECTED]  [EMAIL PROTECTED]
Tourist pics http://portgeographe.environmentaldisasters.cds.merseine.nu/
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED] 
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Re: repeated entries in /var/log/messages...

[Mario Flores]

I really did not know what they are and thought something was going 
wrong. That is why I asked 'how to stop them'. But now I know, it's OK 
to have them :) and how to use them (just in case)

Thank you for your answers,
Mario.
Travis Crump wrote:
Mario Flores wrote:
Hi:
Since day 1 I installed debian, I see the following in the 
/var/log/messages:

Jul 28 21:01:08 woody -- MARK --
Jul 28 21:21:08 woody -- MARK --
Jul 28 21:41:08 woody -- MARK --
and they repeat every single hour at the exact same intervals. Does 
anyone know what they mean and how can I stop them?

I am running the stable release (woody).
Thanks,
Mario.


It's so if your box crashes, you can pinpoint the time of the crash 
even if nothing (else) is being written to logs.  Not sure why you 
care enough to want to stop them...


--
To UNSUBSCRIBE, email to [EMAIL PROTECTED] 
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Re: repeated entries in /var/log/messages...

[Travis Crump]

Mario Flores wrote:
Hi:
Since day 1 I installed debian, I see the following in the 
/var/log/messages:

Jul 28 21:01:08 woody -- MARK --
Jul 28 21:21:08 woody -- MARK --
Jul 28 21:41:08 woody -- MARK --
and they repeat every single hour at the exact same intervals. Does 
anyone know what they mean and how can I stop them?

I am running the stable release (woody).
Thanks,
Mario.


It's so if your box crashes, you can pinpoint the time of the crash even 
if nothing (else) is being written to logs.  Not sure why you care 
enough to want to stop them...


signature.asc
Description: OpenPGP digital signature

Re: repeated entries in /var/log/messages...

[Greg Folkert]

On Wed, 2004-07-28 at 22:11, Mario Flores wrote:
> Hi:
> 
> Since day 1 I installed debian, I see the following in the 
> /var/log/messages:
> 
> Jul 28 21:01:08 woody -- MARK --
> Jul 28 21:21:08 woody -- MARK --
> Jul 28 21:41:08 woody -- MARK --
> 
> and they repeat every single hour at the exact same intervals. Does 
> anyone know what they mean and how can I stop them?

Yes, they mean that the Logging Daemons are running properly. And it
would not be a good idea to stop them. Every 20 minutes... and you are
complaining... that means 3 lines and hours.

I'd be glad if I only had 3 lines an hour in MY logs.
-- 
greg, [EMAIL PROTECTED]

The technology that is
Stronger, better, faster:  Linux


signature.asc
Description: This is a digitally signed message part

RE: repeated entries in /var/log/messages...

[Steven Jones]

It means your log gets time stamped, personally I like it. Makes it a bit more 
difficult for someone to chop out parts of the log to hide things and shows the daemon 
is running, its not unknown for syslog to stop working. 

regards

S

-Original Message-
From: Mario Flores [mailto:[EMAIL PROTECTED]
Sent: Thursday, 29 July 2004 2:12 p.m.
To: [EMAIL PROTECTED]
Subject: repeated entries in /var/log/messages...


Hi:

Since day 1 I installed debian, I see the following in the 
/var/log/messages:

Jul 28 21:01:08 woody -- MARK --
Jul 28 21:21:08 woody -- MARK --
Jul 28 21:41:08 woody -- MARK --

and they repeat every single hour at the exact same intervals. Does 
anyone know what they mean and how can I stop them?

I am running the stable release (woody).

Thanks,

Mario.




-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED] 
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Re: repeated entries in /var/log/messages...

[Simon Kitching]

On Thu, 2004-07-29 at 14:11, Mario Flores wrote:
> Hi:
> 
> Since day 1 I installed debian, I see the following in the 
> /var/log/messages:
> 
> Jul 28 21:01:08 woody -- MARK --
> Jul 28 21:21:08 woody -- MARK --
> Jul 28 21:41:08 woody -- MARK --
> 
> and they repeat every single hour at the exact same intervals. Does 
> anyone know what they mean and how can I stop them?

They are there so that you can be sure the syslogd daemon is still
running. Without these, if syslogd failed you wouldn't be able to tell
from the log files. And as syslogd is often part of the security
infrastructure of a server, that's not good. I believe syslogd can also
log to remote servers, so these mark messages would be extra-useful
then.

man syslogd for more info, particularly the -m option.

syslogd is started by /etc/init.d/sysklogd (note the k). So you can edit
this file to pass whatever -m option you want; zero disables these
messages.

The /var/log/messages file is automatically archived, so I don't see why
you would want to disable the mark messages.

Regards,

Simon




-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED] 
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

repeated entries in /var/log/messages...

[Mario Flores]

Hi:
Since day 1 I installed debian, I see the following in the 
/var/log/messages:

Jul 28 21:01:08 woody -- MARK --
Jul 28 21:21:08 woody -- MARK --
Jul 28 21:41:08 woody -- MARK --
and they repeat every single hour at the exact same intervals. Does 
anyone know what they mean and how can I stop them?

I am running the stable release (woody).
Thanks,
Mario.

--
To UNSUBSCRIBE, email to [EMAIL PROTECTED] 
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Re: /var/log/messages

[Paul Johnson]

I shouldn't have to reformat your text to reply to it.  Please turn
your line wraps on.

On Sat, Feb 22, 2003 at 12:21:01PM -0500, Richard Beri wrote:
> Well the cause of this seems to be a constant stream of messages
> form my cable modem that I can't silence. Something like "SPOOFED
> Packet IN=eth0 and then my MAC address and other network stuff
> including the IP address of the spoofed packet.  This is all coming
> from my cable company, I have talked to them about it but they don't
> really have any idea.  Ever since they upgraded my modem to a DOCSIS
> one, I get a constant stream d/l of ~2k.  I have a firewall
> installed, but even if I block these ports I still get the messages
> in a virtual terminal.

Are you set up like this:

CMNAT box---LAN

Or are you set up like this?

CMLAN-NAT box

I noticed a similar issue when set up using the latter method while I
was testing out a NAT setup so my roommates could still use the
net using ISP assigned IPs.  It went away when I did things the right
way (the first method).

About the transfer rates...try unplugging the cable modem, waiting
about a minute, then plug it back in.  When I used to do tech support
for @Home, this fixed a good 90% of the calls I got.  This trick also
works with elevator controllers where I work, as I discovered about an
hour ago when the damn thing crashed and kicked on the emergency
brakes with two people inside.  Seems with embedded devices like CMs
and elevator controllers, rebooting them makes them just work again.
If that doesn't work in fixing your transfer rates, call your cable
company.  Most companies take action when transfer rates drop below an average
of 50kB/sec from everywhere.

-- 
 .''`. Baloo <[EMAIL PROTECTED]>
: :'  :proud Debian admin and user
`. `'`
  `-  Debian - when you have better things to do than to fix a system


pgp0.pgp
Description: PGP signature

Re: /var/log/messages

[Richard Beri]

> Don't know what firewall you're running; nor how to make it stop logging
> that stuff.

> I'm not familiar with this port; but, you gotta wonder why aci.on.ca is
> broadcasting http?

aci.on.ca is my ISP.  Its a small local cable co.


-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED] 
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Re: /var/log/messages

[Michael D. Schleif]

Also sprach Richard Beri (Sat 22 Feb 02003 at 07:29:38PM -0500):
> Feb 21 22:18:24 stormix kernel: SPOOFED Packet IN=eth0 OUT= 
> MAC=ff:ff:ff:ff:ff:ff:00:d0:59:2d:4b:e4:08:00 SRC=209.135.93.166 DST=255.255.255.255 
> LEN=40 TOS=0x00 PREC=0x00 TTL=128 ID=8420 PROTO=UDP SPT=2301 DPT=2301 LEN=20
> 
> I get this error messages in my /var/log/messages every 2 or so seconds.
> 
> Any ideas how I can silence it? Or tell me whats going on, because I don't really 
> understand it.

Don't know what firewall you're running; nor how to make it stop logging
that stuff.

However, it is interesting to note:

SRC=209.135.93.166 ==> xtreme30-166.aci.on.ca

SPT=2301 DPT=2301

According to <http://www.iana.org/assignments/port-numbers> this is:
cpq-wbem2301/tcp   Compaq HTTP
cpq-wbem2301/udp   Compaq HTTP
#  Scott Shaffer <[EMAIL PROTECTED]>

I'm not familiar with this port; but, you gotta wonder why aci.on.ca is
broadcasting http?

hth

-- 
Best Regards,

mds
mds resource
888.250.3987
-
Dare to fix things before they break . . .
-
Our capacity for understanding is inversely proportional to how much
we think we know.  The more I know, the more I know I don't know . . .
--


-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED] 
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Re: /var/log/messages

[Richard Beri]

Feb 21 22:18:24 stormix kernel: SPOOFED Packet IN=eth0 OUT= 
MAC=ff:ff:ff:ff:ff:ff:00:d0:59:2d:4b:e4:08:00 SRC=209.135.93.166 DST=255.255.255.255 
LEN=40 TOS=0x00 PREC=0x00 TTL=128 ID=8420 PROTO=UDP SPT=2301 DPT=2301 LEN=20

I get this error messages in my /var/log/messages every 2 or so seconds.

Any ideas how I can silence it? Or tell me whats going on, because I don't really 
understand it.


-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED] 
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Re: /var/log/messages

[Michael D. Schleif]

Also sprach Richard Beri (Sat 22 Feb 02003 at 12:21:01PM -0500):
> 
> > I wouldn't delete logs.  Sometimes you need them.  Go install
> > logrotate if it's not alredy installed, if it is, play with the
> > settings until you get something a bit more desirable.  It'll keep
> > your logs pruned.
> 
> Well the cause of this seems to be a constant stream of messages form
> my cable modem that I can't silence. Something like "SPOOFED Packet
> IN=eth0 and then my MAC address and other network stuff including the
> IP address of the spoofed packet.  This is all coming from my cable
> company, I have talked to them about it but they don't really have any
> idea.  Ever since they upgraded my modem to a DOCSIS one, I get a
> constant stream d/l of ~2k.  I have a firewall installed, but even if
> I block these ports I still get the messages in a virtual terminal.
> 
> So this is how my messages file gets so big.  I've set the logs to
> rotate at 10M as per someones instructions above.
> 
> If you guys have any ideas how I can silence these messages from my
> modem, it would be greatly appreciated. 

Please, post the *exact* error messages and somebody will be able to
help . . .

-- 
Best Regards,

mds
mds resource
888.250.3987
-
Dare to fix things before they break . . .
-
Our capacity for understanding is inversely proportional to how much
we think we know.  The more I know, the more I know I don't know . . .
--


-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED] 
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Re: /var/log/messages

[Richard Beri]

> I wouldn't delete logs.  Sometimes you need them.  Go install
> logrotate if it's not alredy installed, if it is, play with the
> settings until you get something a bit more desirable.  It'll keep
> your logs pruned.

Well the cause of this seems to be a constant stream of messages form my cable modem 
that I can't silence. Something like "SPOOFED Packet IN=eth0 and then my MAC address 
and other network stuff including the IP address of the spoofed packet.  This is all 
coming from my cable company, I have talked to them about it but they don't really 
have any idea.  Ever since they upgraded my modem to a DOCSIS one, I get a constant 
stream d/l of ~2k.  I have a firewall installed, but even if I block these ports I 
still get the messages in a virtual terminal.

So this is how my messages file gets so big.  I've set the logs to rotate at 10M as 
per someones instructions above.

If you guys have any ideas how I can silence these messages from my modem, it would be 
greatly appreciated. 


-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED] 
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Re: /var/log/messages

[Paul Johnson]

On Fri, Feb 21, 2003 at 03:03:57PM +0900, Nick Hastings wrote:
> > If you just want to "reset" the files without a backup, as root
> > type in: "touch /var/log/messages". (minus the quotes and the .)
> 
> Won't that just change the access and modification time of the file?
> That happens every 20 minutes anyway (-- MARK --). What else does
> that achieve? 

Touch also will create a zero-sized file.  You used to have to touch a
file if it didn't exist before you could edit it in vi once apon a
time.  Log daemons don't tend to like not having a file to add to,
even if it's a zero size one.

-- 
 .''`. Baloo <[EMAIL PROTECTED]>
: :'  :proud Debian admin and user
`. `'`
  `-  Debian - when you have better things to do than to fix a system


pgp0.pgp
Description: PGP signature

Re: /var/log/messages

[Paul Johnson]

On Thu, Feb 20, 2003 at 09:39:11PM -0500, Richard Beri wrote:
> My /var/log/messages and messages.0 are getting very large. messages
> alone is almost 500 meg.  Is is safe to delete these files (I don't
> need to read any back error messages).  

I wouldn't delete logs.  Sometimes you need them.  Go install
logrotate if it's not alredy installed, if it is, play with the
settings until you get something a bit more desirable.  It'll keep
your logs pruned.

-- 
 .''`. Baloo <[EMAIL PROTECTED]>
: :'  :proud Debian admin and user
`. `'`
  `-  Debian - when you have better things to do than to fix a system


pgp0.pgp
Description: PGP signature

Re: /var/log/messages

[Dana J. Laude]

On Fri, Feb 21, 2003 at 03:03:57PM +0900 or thereabouts, Nick Hastings wrote:
> * Dana J. Laude <[EMAIL PROTECTED]> [030221 14:47]:
> > On Thu, Feb 20, 2003 at 09:39:11PM -0500 or thereabouts, Richard Beri wrote:
> > > My /var/log/messages and messages.0 are getting very large. messages
> > > alone is almost 500 meg.  Is is safe to delete these files (I don't]
> > > need to read any back error messages).  My syslog is also reaching 500
> > >  meg ais that safe to be deleted. Will they be auto-created again
> > 
> > If you just want to "reset" the files without a backup, as root
> > type in: "touch /var/log/messages". (minus the quotes and the .)
> 
> Won't that just change the access and modification time of the file?
> That happens every 20 minutes anyway (-- MARK --). What else does
> that achieve?

You're absolutly correct.  I normally "rm filename" and then do the
above to create a new 0 byte file. Thanks for pointing that out.

Dana 


-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED] 
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Re: /var/log/messages

[Michael D. Schleif]

Also sprach Richard Beri (Fri 21 Feb 02003 at 07:52:59PM -0500):
> On Thu, 20 Feb 2003 23:47:34 -0600
> "Michael D. Schleif" <[EMAIL PROTECTED]> wrote:
> 
> > If I had a logfile that large, I would assume that there is something
> > wrong with my system.  Only after careful scrutiny of that logfile, and
> > correction of all conditions generating verbose messages, then I would
> > consider deleting said logfiles.
> > 
> > What do you think?
> 
> I have a cable modem that spews errors in a virtual terminal, I silenced them, but I 
> assume that they go into /var/log/messages.  My system has been on for almost 2 
> years non-stop.  I also have logrotate installed, so I don't know why they are 
> getting so large.  The files are that large now that I can't read them (with vi 
> anyway).

Look here:

man logrotate

I do not know what version you are using; nor do I see how my default
logrotate process handles signaling syslogd; but, you may consider
putting something like this near the bottom of your /etc/logrotate.conf:

/var/log/messages {
rotate 5
size=10M
postrotate
/sbin/killall -HUP syslogd
}

What do you think?

-- 
Best Regards,

mds
mds resource
888.250.3987
-
Dare to fix things before they break . . .
-
Our capacity for understanding is inversely proportional to how much
we think we know.  The more I know, the more I know I don't know . . .
--


-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED] 
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Re: /var/log/messages

[Nick Hastings]

* Dana J. Laude <[EMAIL PROTECTED]> [030221 14:47]:
> On Thu, Feb 20, 2003 at 09:39:11PM -0500 or thereabouts, Richard Beri wrote:
> > My /var/log/messages and messages.0 are getting very large. messages
> > alone is almost 500 meg.  Is is safe to delete these files (I don't]
> > need to read any back error messages).  My syslog is also reaching 500
> >  meg ais that safe to be deleted. Will they be auto-created again
> 
> If you just want to "reset" the files without a backup, as root
> type in: "touch /var/log/messages". (minus the quotes and the .)

Won't that just change the access and modification time of the file?
That happens every 20 minutes anyway (-- MARK --). What else does
that achieve? 

Nick.


-- 
Debian testing/unstable
Linux onefish 2.4.20-lavienx #1 Mon Jan 6 17:03:01 JST 2003
i686 unknown unknown GNU/Linux


-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED] 
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Re: /var/log/messages

[Michael D. Schleif]

Richard Beri wrote:
> 
> My /var/log/messages and messages.0 are getting very large. messages alone is almost 
>500 meg.  Is is safe to delete these files (I don't need to read any back error 
>messages).  My syslog is also reaching 500 meg ais that safe to be deleted. Will they 
>be auto-created again?

Prior to deleting any logfiles, perhaps, you might want to know whether
or not there is anything inside the logfile that is important?

If I had a logfile that large, I would assume that there is something
wrong with my system.  Only after careful scrutiny of that logfile, and
correction of all conditions generating verbose messages, then I would
consider deleting said logfiles.

What do you think?

-- 

Best Regards,

mds
mds resource
888.250.3987

Dare to fix things before they break . . .

Our capacity for understanding is inversely proportional to how much we
think we know.  The more I know, the more I know I don't know . . .


-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED] 
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Re: /var/log/messages

[Dana J. Laude]

On Thu, Feb 20, 2003 at 09:39:11PM -0500 or thereabouts, Richard Beri wrote:
> My /var/log/messages and messages.0 are getting very large. messages
> alone is almost 500 meg.  Is is safe to delete these files (I don't]
> need to read any back error messages).  My syslog is also reaching 500
>  meg ais that safe to be deleted. Will they be auto-created again

If you just want to "reset" the files without a backup, as root
type in: "touch /var/log/messages". (minus the quotes and the .)

Dana


-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED] 
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Re: /var/log/messages

[Richard Hector]

On Thu, Feb 20, 2003 at 09:23:05PM -0700, Andreas J Guelzow wrote:
> Richard Beri wrote:
> 
> >My /var/log/messages and messages.0 are getting very large. messages alone 
> 
> you may want to install logrotate, that will rotate those log files for you.

Um - doesn't hte existence of messages.0 indicate that the logs are being
rotated?

It might be necessary to adjust logrotate, and/or figure out why so much
log traffic is being generated.

Richard


-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED] 
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Re: /var/log/messages

[Michael Wardle]

On Friday, February 21, 2003 13:39, Richard Beri wrote:
> My /var/log/messages and messages.0 are getting very large. messages
> alone is almost 500 meg.  Is is safe to delete these files (I don't
> need to read any back error messages).  My syslog is also reaching
> 500 meg ais that safe to be deleted. Will they be auto-created again?

For next time, you might like to discover a utility called logrotate.  
It will regularly archive and/or delete old log files and set up new 
empty ones in their place.

I think you can empty a file (while preserving its permissions) by 
overwriting it with the empty string:
# echo "" > /var/log/messages

Hope this helps

-- 
Michael Wardle
Adacel Technologies



-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED] 
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Re: /var/log/messages

[Jacob S .]

On Thu, 20 Feb 2003 21:39:11 -0500
Richard Beri <[EMAIL PROTECTED]> wrote:

> My /var/log/messages and messages.0 are getting very large. messages
> alone is almost 500 meg.  Is is safe to delete these files (I don't
> need to read any back error messages).  My syslog is also reaching 500
> meg ais that safe to be deleted. Will they be auto-created again?
> 
> Thanks

If you simply need hard drive space, I would recommend something like
burning the logs to a cd before deleting them from your hard drive. Just
in case.

Next I'd probably do an "apt-get install logrotate" so that your log
files are in smaller, more easily manageable sizes. 

HTH,
Jacob

- 
GnuPG Key: 1024D/16377135

In a world without fences, who needs Gates?
http://www.linux.org/



msg32029/pgp0.pgp
Description: PGP signature

Re: /var/log/messages

[Andreas J Guelzow]

Richard Beri wrote:


My /var/log/messages and messages.0 are getting very large. messages alone is almost 500 meg.  Is is safe to delete these files (I don't need to read any back error messages).  My syslog is also reaching 500 meg ais that safe to be deleted. Will they be auto-created again?



you may want to install logrotate, that will rotate those log files for you.

Andreas





--
Prof. Dr. Andreas J. Guelzow
http://www.math.concordia.ab.ca/aguelzow


--
To UNSUBSCRIBE, email to [EMAIL PROTECTED] 
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

/var/log/messages

[Richard Beri]

My /var/log/messages and messages.0 are getting very large. messages alone is almost 
500 meg.  Is is safe to delete these files (I don't need to read any back error 
messages).  My syslog is also reaching 500 meg ais that safe to be deleted. Will they 
be auto-created again?

Thanks


-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED] 
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

RE: /var/log/messages notifyd on MUA server

[justin cunningham]

Excerpt from:  http://www.dartmouth.edu/pages/softdev/blitz.html

Mailing List
There is a mailing list for discussion of BlitzMail system
administration. To join the list send a message to
[EMAIL PROTECTED] with the word "subscribe" in the body
of the message. To send mail to the list send it to
[EMAIL PROTECTED] . You can also send mail directly to the
BlitzMail developers at [EMAIL PROTECTED] .



-Original Message-
From: Ted Knab [mailto:[EMAIL PROTECTED] On Behalf Of Thedore
Knab
Sent: Thursday, January 03, 2002 7:14 AM
To: debian-user@lists.debian.org
Subject: /var/log/messages notifyd on MUA server

I have found the following error in /var/log/messages:

Does anyone know what this mean ?

This machine is running blitzmail an MUA.


Jann  3 10:05:31 blitzhost notifyd: atpread: short packet
ignored 
Jan  3 10:06:06 blitzhost last message repeated 2 times 
Jan  3 10:06:16 blitzhost notifyd: atpread: short packet
ignored 
Jan  3 10:06:52 blitzhost last message repeated 2 times
Jan  3 10:08:31 blitzhost last message repeated 6
times

Ted Knab


-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED] 
with a subject of "unsubscribe". Trouble? Contact
[EMAIL PROTECTED]

/var/log/messages notifyd on MUA server

[Thedore Knab]

I have found the following error in /var/log/messages:

Does anyone know what this mean ?

This machine is running blitzmail an MUA.


Jann  3 10:05:31 blitzhost notifyd: atpread: short packet
ignored 
Jan  3 10:06:06 blitzhost last message repeated 2 times 
Jan  3 10:06:16 blitzhost notifyd: atpread: short packet
ignored 
Jan  3 10:06:52 blitzhost last message repeated 2 times
Jan  3 10:08:31 blitzhost last message repeated 6
times

Ted Knab

Re: /var/log/messages on the desktop

[Karsten M. Self]

on Sat, Nov 10, 2001 at 09:41:12AM -0500, Sunny Dubey ([EMAIL PROTECTED]) wrote:
> hey,
> 
> how do people get messages that get added to /var/log/messages printed to 
> their desktops ??
> 
> sort of like the following desktop-screenshot at the bottom
> 
> http://indigo.ie/~fowler/screenshot.jpg

apt-get install xrootconsole

Displays messages to the X root window.  Screenshots:

http://kmself.home.netcom.com/Images/Desktop/

...scroll down past the first few thumbnails.

It's actually a hacked terminal, IIRC.  You can get a similar result by
taking a transparent terminal stripping all scrollbars and decorations,
and sinking it to the bottom of your window stack.  I've done this with
wterm, for example.  In some cases, the transparency handling is better,
e.g.: if you change your background color or image, wterm picks up the
changes, xrootconsole doesn't.

Peace.

-- 
Karsten M. Selfhttp://kmself.home.netcom.com/
 What part of "Gestalt" don't you understand? Home of the brave
  http://gestalt-system.sourceforge.net/   Land of the free
   Free Dmitry! Boycott Adobe! Repeal the DMCA! http://www.freesklyarov.org
Geek for Hire http://kmself.home.netcom.com/resume.html


pgpySmyAoln0A.pgp
Description: PGP signature

Re: /var/log/messages on the desktop

[Sean Quinlan]

--- Sunny Dubey <[EMAIL PROTECTED]> (2001-11-10 14:40):
> how do people get messages that get added to /var/log/messages printed to 
> their desktops ??

Try the package root-tail.

Cheers,
Sean

-- 
Sean Quinlan ([EMAIL PROTECTED])

Re: /var/log/messages on the desktop

[Wayne Topa]

Sunny Dubey([EMAIL PROTECTED]) is reported to have said:
> hey,
> 
> how do people get messages that get added to /var/log/messages printed to 
> their desktops ??
> 
> sort of like the following desktop-screenshot at the bottom
> 
> http://indigo.ie/~fowler/screenshot.jpg
> 

Maybe you mean this

xconsole -file /dev/xconsole 

-- 
Build a system that even a fool can use, and only a fool will use it.
___

/var/log/messages on the desktop

[Sunny Dubey]

hey,

how do people get messages that get added to /var/log/messages printed to 
their desktops ??

sort of like the following desktop-screenshot at the bottom

http://indigo.ie/~fowler/screenshot.jpg

thanks

/var/log/messages permissions woes

[au516]

Hello all,
This is a real mystery for me, and I need an answer to this problem:

As a regular user (not root) I want to be able to do a 'tail -f
/var/log/messages' whenever I dialup my ISP.  This is all set up fine
but there is a recurring permissions problem:  every time I reboot,
*something* changes the group permissions of /var/log/messages 
FROM:
-rw-r-1 root adm225523 May 18 13:15 /var/log/messages
 ^^^
BACK TO:
-rw-r-1 root root   225523 May 18 13:15 /var/log/messages
 
I chgrp back to adm, and something changes it back to root, etc.

I have looked through /etc/cron.daily and found nothing.  I have looked
through /etc/init.d shell scripts.  I have tried tracking the
permissions change through syslogd logging - all unsuccessful.  I cannot
seem to locate what mechanism is automatically changing this files
permissions.

Debian gurus - help?

R.

Re: /var/log/messages questions

[Erik Steffl]

Michelle Murrain wrote:
> 
> Hi folks,
> 
> 2 strange (to me) messages appear in my /var/log/messages file. Any ideas on
> these?
> 
> First, simply:
> 
> Nov 28 10:41:52 blackbear -- MARK --
> Nov 28 11:01:52 blackbear -- MARK --
> Nov 28 11:21:52 blackbear -- MARK --
> Nov 28 11:41:52 blackbear -- MARK --
> Nov 28 12:01:52 blackbear -- MARK --
> Nov 28 12:21:52 blackbear -- MARK --
> 
> Every 20 minutes. No, I don't have any cron or at jobs going at this interval.

  that's just a mark:-) so that you see that the system was alive and
kicking at that time. you can set the frequency od these messages, I
forgot how...

> Second is more disturbing...
> 
> Nov 22 06:26:53 blackbear kernel: Directory sread (sector 0x1b) failed
> Nov 22 06:26:53 blackbear kernel: attempt to access beyond end of device
> Nov 22 06:26:53 blackbear kernel: 02:00: rw=0, want=14, limit=4

  I bet 02:00 says which device this message refers to but I have no
clue which one it actually is or what does it mean. I would search the
kernel sources for parts of those messages...

erik

Re: /var/log/messages questions

[Pollywog]

On Tue, 28 Nov 2000 19:30:28 -0500, Michelle Murrain said:

> Hi folks,
>  
>  2 strange (to me) messages appear in my /var/log/messages file. Any ideas on 
>  these?
>  
>  First, simply:
>  
>  Nov 28 10:41:52 blackbear -- MARK --
>  Nov 28 11:01:52 blackbear -- MARK --
>  Nov 28 11:21:52 blackbear -- MARK --
>  Nov 28 11:41:52 blackbear -- MARK --
>  Nov 28 12:01:52 blackbear -- MARK --
>  Nov 28 12:21:52 blackbear -- MARK --  

These are normal entries which I believe are used internally by syslogd.

>  
>  
>  Every 20 minutes. No, I don't have any cron or at jobs going at this 
> interval.
>  
>  Second is more disturbing...
>  
>  Nov 22 06:26:53 blackbear kernel: Directory sread (sector 0x1b) failed
>  Nov 22 06:26:53 blackbear kernel: attempt to access beyond end of device
>  Nov 22 06:26:53 blackbear kernel: 02:00: rw=0, want=14, limit=4
>  
>  This happened a lot at one point. I can't tell what device it's talking 
> about.

This one would concern me also, but I don't know what it means.

--
Andrew

Re: /var/log/messages questions

[Colin Watson]

[EMAIL PROTECTED] wrote:
>2 strange (to me) messages appear in my /var/log/messages file. Any ideas on 
>these?
>
>First, simply:
>
>Nov 28 10:41:52 blackbear -- MARK --
>Nov 28 11:01:52 blackbear -- MARK --
>Nov 28 11:21:52 blackbear -- MARK --
>Nov 28 11:41:52 blackbear -- MARK --
>Nov 28 12:01:52 blackbear -- MARK --
>Nov 28 12:21:52 blackbear -- MARK --  
>
>
>Every 20 minutes. No, I don't have any cron or at jobs going at this interval.

The sysklogd(8) man page has this to say:

   -m interval
  The syslogd logs a mark timestamp  regularly.   The
  default interval between two -- MARK -- lines is 20
  minutes.  This can be  changed  with  this  option.
  Setting the interval to zero turns it off entirely.

>Second is more disturbing...
>
>Nov 22 06:26:53 blackbear kernel: Directory sread (sector 0x1b) failed
>Nov 22 06:26:53 blackbear kernel: attempt to access beyond end of device
>Nov 22 06:26:53 blackbear kernel: 02:00: rw=0, want=14, limit=4
>
>This happened a lot at one point. I can't tell what device it's talking about.

According to /usr/src/linux/Documentation/devices.txt, 02:00 (that is,
the device with major number 2 and minor number 0 - presumably a block
device) is /dev/fd0, your first floppy drive. Knowing floppies, you
*probably* don't need to be too concerned about this.

Cheers,

-- 
Colin Watson [EMAIL PROTECTED]

/var/log/messages questions

[Michelle Murrain]

Hi folks,

2 strange (to me) messages appear in my /var/log/messages file. Any ideas on 
these?

First, simply:

Nov 28 10:41:52 blackbear -- MARK --
Nov 28 11:01:52 blackbear -- MARK --
Nov 28 11:21:52 blackbear -- MARK --
Nov 28 11:41:52 blackbear -- MARK --
Nov 28 12:01:52 blackbear -- MARK --
Nov 28 12:21:52 blackbear -- MARK --  


Every 20 minutes. No, I don't have any cron or at jobs going at this interval.

Second is more disturbing...

Nov 22 06:26:53 blackbear kernel: Directory sread (sector 0x1b) failed
Nov 22 06:26:53 blackbear kernel: attempt to access beyond end of device
Nov 22 06:26:53 blackbear kernel: 02:00: rw=0, want=14, limit=4

This happened a lot at one point. I can't tell what device it's talking about.

Thanks!
Michelle
-- 
-
MIchelle Murrain
[EMAIL PROTECTED]

Re: Strange /var/log/messages and /var/log/syslog

[Michael Wuertz]

On Tue, Oct 10, 2000 at 09:48:49AM +0200, Rob Kaper wrote:
> On Tue, Oct 10, 2000 at 10:37:32AM +0300, Debian User wrote:
> >     My /var/log/messages and /var/log/syslog files looks very strange. I
> > attached them to this mail. Can you tell me why the lines are marked like
> > this ? I have installed potato.
> 
> > Oct 10 08:08:01 ady /USR/SBIN/CRON[5987]: (mail) CMD (  if [ -x 
> > /usr/sbin/exim -a -f /etc/exim.conf ]; then /usr/sbin/exim -q >/dev/null 
> > 2>&1; fi)
> 
> This means the program 'exim' is run by crond, so it is probably in the
> crontab of you or one of your users. I doubt that is a security risk, but in
> case you do not know about exim and what it does you might want to
> investigate.

exim is a sendmail replacement. the cron job just flushes the mail
queue, I suppose.

Michael Würtz

-- 
Michael Wuertz

* magic is real - unless declared integer *

Re: Strange /var/log/messages and /var/log/syslog

[Rob Kaper]

On Tue, Oct 10, 2000 at 10:37:32AM +0300, Debian User wrote:
> My /var/log/messages and /var/log/syslog files looks very strange. I
> attached them to this mail. Can you tell me why the lines are marked like
> this ? I have installed potato.

> Oct  8 08:11:16 ady -- MARK --

This is just a little syslogd (op perhaps kernel?) stamp every twenty
minutes without any activity and nothing to worry about.

> Oct 10 08:08:01 ady /USR/SBIN/CRON[5987]: (mail) CMD (  if [ -x 
> /usr/sbin/exim -a -f /etc/exim.conf ]; then /usr/sbin/exim -q >/dev/null 
> 2>&1; fi)

This means the program 'exim' is run by crond, so it is probably in the
crontab of you or one of your users. I doubt that is a security risk, but in
case you do not know about exim and what it does you might want to
investigate.

Grtz,
Rob
-- 
Rob Kaper | [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL 
PROTECTED]
  | http://capsi.com/ - telnet://chat.capsi.com:2300/
  | 'What? In riddles?' said Gandalf. 'No! For I was talking aloud
  | to myself. A habit of the old: they choose the wisest person
  | present to speak to; the long explanations needed by the young
  | are wearying.' - "Lord of the Rings", JRR Tolkien

Re: Strange /var/log/messages and /var/log/syslog

[Ingemar Fällman]

Don't worry about it.
-- MARK -- is there to tell you that the sytem was up and runing.
So with the marks you can see if your system has been down for example 
between1am and 5am.

/Ingemar

Debian User wrote:

>     My /var/log/messages and /var/log/syslog files looks very strange. I
> attached them to this mail. Can you tell me why the lines are marked
> like this ? I have installed potato.
>
> Adrian Nims
>
>   
> Oct  8 06:48:12 ady syslogd 1.3-3#33.1: restart.
> Oct  8 07:11:16 ady -- MARK --
> Oct  8 07:31:16 ady -- MARK --
>
>
>   
> Oct 10 06:25:38 ady syslogd 1.3-3#33.1: restart.
> Oct 10 06:38:01 ady /USR/SBIN/CRON[5857]: (mail) CMD (  if [ -x 
> /usr/sbin/exim -a -f /etc/exim.conf ]; then /usr/sbin/exim -q >/dev/null 
> 2>&1; fi)
> Oct 10 06:51:16 ady -- MARK --

--
Ingemar Fällman  Phone: +46(0)90 786 9335
UMDAC, Umeå University   Fax:   +46(0)90 786 6762
S-901 87 UMEÅ, SWEDENMailTo:[EMAIL PROTECTED]

$_ = "I'n Jvtu bopuifs Pfsm ibdlfs,"; y/a-z/za-y/; print "$_\n";

Strange /var/log/messages and /var/log/syslog

[Debian User]

My /var/log/messages and /var/log/syslog files looks very strange. I
attached them to this mail. Can you tell me why the lines are marked
like this ? I have installed potato.


Adrian Nims


Oct  8 06:48:12 ady syslogd 1.3-3#33.1: restart.
Oct  8 07:11:16 ady -- MARK --
Oct  8 07:31:16 ady -- MARK --
Oct  8 07:51:16 ady -- MARK --
Oct  8 08:11:16 ady -- MARK --
Oct  8 08:31:16 ady -- MARK --
Oct  8 08:51:16 ady -- MARK --
Oct  8 09:11:16 ady -- MARK --
Oct  8 09:31:16 ady -- MARK --
Oct  8 09:51:16 ady -- MARK --
Oct  8 10:11:16 ady -- MARK --
Oct  8 10:31:16 ady -- MARK --
Oct  8 10:51:16 ady -- MARK --
Oct  8 11:11:16 ady -- MARK --
Oct  8 11:31:16 ady -- MARK --
Oct  8 11:51:16 ady -- MARK --
Oct  8 12:11:16 ady -- MARK --
Oct  8 12:31:16 ady -- MARK --
Oct  8 12:51:16 ady -- MARK --
Oct  8 13:11:16 ady -- MARK --
Oct  8 13:31:16 ady -- MARK --
Oct  8 13:51:16 ady -- MARK --
Oct  8 14:11:16 ady -- MARK --
Oct  8 14:31:16 ady -- MARK --
Oct  8 14:51:16 ady -- MARK --
Oct  8 15:11:16 ady -- MARK --
Oct  8 15:31:16 ady -- MARK --
Oct  8 15:51:16 ady -- MARK --
Oct  8 16:11:16 ady -- MARK --
Oct  8 16:31:16 ady -- MARK --
Oct  8 16:51:16 ady -- MARK --
Oct  8 17:11:16 ady -- MARK --
Oct  8 17:31:16 ady -- MARK --
Oct  8 17:51:16 ady -- MARK --
Oct  8 18:11:16 ady -- MARK --
Oct  8 18:31:16 ady -- MARK --
Oct  8 18:51:16 ady -- MARK --
Oct  8 19:11:16 ady -- MARK --
Oct  8 19:31:16 ady -- MARK --
Oct  8 19:51:16 ady -- MARK --
Oct  8 20:11:16 ady -- MARK --
Oct  8 20:31:16 ady -- MARK --
Oct  8 20:51:16 ady -- MARK --
Oct  8 21:11:16 ady -- MARK --
Oct  8 21:31:16 ady -- MARK --
Oct  8 21:51:16 ady -- MARK --
Oct  8 22:11:16 ady -- MARK --
Oct  8 22:31:16 ady -- MARK --
Oct  8 22:51:16 ady -- MARK --
Oct  8 23:11:16 ady -- MARK --
Oct  8 23:31:16 ady -- MARK --
Oct  8 23:51:16 ady -- MARK --
Oct  9 00:11:16 ady -- MARK --
Oct  9 00:31:16 ady -- MARK --
Oct  9 00:51:16 ady -- MARK --
Oct  9 01:11:16 ady -- MARK --
Oct  9 01:31:16 ady -- MARK --
Oct  9 01:51:16 ady -- MARK --
Oct  9 02:11:16 ady -- MARK --
Oct  9 02:31:16 ady -- MARK --
Oct  9 02:51:16 ady -- MARK --
Oct  9 03:11:16 ady -- MARK --
Oct  9 03:31:16 ady -- MARK --
Oct  9 03:51:16 ady -- MARK --
Oct  9 04:11:16 ady -- MARK --
Oct  9 04:31:16 ady -- MARK --
Oct  9 04:51:16 ady -- MARK --
Oct  9 05:11:16 ady -- MARK --
Oct  9 05:31:16 ady -- MARK --
Oct  9 05:51:16 ady -- MARK --
Oct  9 06:11:16 ady -- MARK --
Oct  9 06:25:18 ady syslogd 1.3-3#33.1: restart.
Oct  9 06:51:16 ady -- MARK --
Oct  9 07:11:16 ady -- MARK --
Oct  9 07:31:16 ady -- MARK --
Oct  9 07:51:16 ady -- MARK --
Oct  9 08:11:16 ady -- MARK --
Oct  9 08:31:16 ady -- MARK --
Oct  9 08:51:16 ady -- MARK --
Oct  9 09:11:16 ady -- MARK --
Oct  9 09:31:16 ady -- MARK --
Oct  9 09:51:16 ady -- MARK --
Oct  9 10:11:16 ady -- MARK --
Oct  9 10:31:16 ady -- MARK --
Oct  9 10:51:16 ady -- MARK --
Oct  9 11:11:16 ady -- MARK --
Oct  9 11:31:16 ady -- MARK --
Oct  9 11:51:16 ady -- MARK --
Oct  9 12:11:16 ady -- MARK --
Oct  9 12:31:16 ady -- MARK --
Oct  9 12:51:16 ady -- MARK --
Oct  9 13:11:16 ady -- MARK --
Oct  9 13:31:16 ady -- MARK --
Oct  9 13:51:16 ady -- MARK --
Oct  9 14:11:16 ady -- MARK --
Oct  9 14:31:16 ady -- MARK --
Oct  9 14:51:16 ady -- MARK --
Oct  9 15:11:16 ady -- MARK --
Oct  9 15:31:16 ady -- MARK --
Oct  9 15:51:16 ady -- MARK --
Oct  9 16:11:16 ady -- MARK --
Oct  9 16:31:16 ady -- MARK --
Oct  9 16:51:16 ady -- MARK --
Oct  9 17:11:16 ady -- MARK --
Oct  9 17:31:16 ady -- MARK --
Oct  9 17:51:16 ady -- MARK --
Oct  9 18:11:16 ady -- MARK --
Oct  9 18:31:16 ady -- MARK --
Oct  9 18:51:16 ady -- MARK --
Oct  9 19:11:16 ady -- MARK --
Oct  9 19:31:16 ady -- MARK --
Oct  9 19:51:16 ady -- MARK --
Oct  9 20:11:16 ady -- MARK --
Oct  9 20:31:16 ady -- MARK --
Oct  9 20:51:16 ady -- MARK --
Oct  9 21:11:16 ady -- MARK --
Oct  9 21:31:16 ady -- MARK --
Oct  9 21:51:16 ady -- MARK --
Oct  9 22:11:16 ady -- MARK --
Oct  9 22:31:16 ady -- MARK --
Oct  9 22:51:16 ady -- MARK --
Oct  9 23:11:16 ady -- MARK --
Oct  9 23:31:16 ady -- MARK --
Oct  9 23:51:16 ady -- MARK --
Oct 10 00:11:16 ady -- MARK --
Oct 10 00:31:16 ady -- MARK --
Oct 10 00:51:16 ady -- MARK --
Oct 10 01:11:16 ady -- MARK --
Oct 10 01:31:16 ady -- MARK --
Oct 10 01:51:16 ady -- MARK --
Oct 10 02:11:16 ady -- MARK --
Oct 10 02:31:16 ady -- MARK --
Oct 10 02:51:16 ady -- MARK --
Oct 10 03:11:16 ady -- MARK --
Oct 10 03:31:16 ady -- MARK --
Oct 10 03:51:16 ady -- MARK --
Oct 10 04:11:16 ady -- MARK --
Oct 10 04:31:16 ady -- MARK --
Oct 10 04:51:16 ady -- MARK --
Oct 10 05:11:16 ady -- MARK --
Oct 10 05:31:16 ady -- MARK --
Oct 10 05:51:16 ady -- MARK --
Oct 10 06:11:16 ady -- MARK --
Oct 10 06:25:38 ady syslogd 1.3-3#33.1: restart.
Oct 10 06:51:16 ady -- MARK --
Oct 10 07:11:16 ady -- MARK --
Oct 10 07:31:16 ady -- MARK --
Oct 10 07:51:16 ady -- MARK --
Oct 10 08:11:16 ady -- MARK --
Oct 10 08:31:16 ady -- MARK --
Oct 10 08:51:16 ady -- MARK --
Oct 10 09:11:16 ady -- MARK --
Oct 10 09:31:16 ady -- MARK --
Oct 10

Re: Trimming down of /var/log/messages

[USM Bish]

On Mon, Sep 04, 2000 at 01:51:50PM +0900, Olaf Meeuwissen wrote:
> USM Bish <[EMAIL PROTECTED]> writes:
> 
> > Is there a recommended way wherein I keep the log for the
> > last seven days only, with some process at boot-up or cron ?
> 
> Seems like logrotate will fit your bill.
> 
>   Package: logrotate
>   Priority: important
>   Section: admin
>   Conffiles:
>/etc/logrotate.conf 70593fe48cb39133328b42a560b5a8cf
>   Description: Log rotation utility
>The logrotate utility is designed to simplify the administration of
>log files on a system which generates a lot of log files.
>Logrotate allows for the automatic rotation compression, removal
>and mailing of log files.  Logrotate can be set to handle a log
>file daily, weekly, monthly or when the log file gets to a certain
>size.  Normally, logrotate runs as a daily cron job.
> 

Thanks for the input. I'll try to do an apt-get
for logrotate if I get a Slink binary on one of
the debian mirrors.  Should be a handy thing to
try out.

USM Bish

Re: Trimming down of /var/log/messages

[USM Bish]

On Sun, Sep 03, 2000 at 09:56:36PM -0700, Alvin Oga wrote:
> 
> hi ya
> 
> make sure cron is runningit already rotates log files
> weekly/monthly... at least on the 1u raid5 debian box
> i poke around in
> 

I need to do some reading on 'cron', and actually do
some fine-tuning.  I have 'cron' running but it does
not seem to rotate my log files as routine. The size
of my messages file is over 1 mb and it has not been
rotated at all.

If someone can give an input in this direction .. it
would be of great help.


> if you want to manually rotate your logs
> 
> kill syslogd or sysklogdthan move it aside...
> but you must also kill things like the web server
> too that logs stuff into /var/log/httpd/ and more stuff to retart
> 

Oh No! For a non-techie like me that would surely be
a nightmare !

> simple silly way...that will always work...
> - mv /var/log /var/log.old ; mkdir /var/log
> - reboot
>   - and it should all be cleaned up by itself
> 

No, this simple hack is not the answer. I did try it
out because of its simplicity. However, the /var/log
directory has other stuff which are  needed by other
programs. The following went kaput:

a. dwww.
b. Apache server of my two computer local network at
   home.
c. news.

There may be more, but I did not try others out, and 
restored the system back with the old /var/log.

Thanks for the hint anyway!  The stupid old me never
thought of doing it at shut-down, with a fix on cron
and boot-up.  This lit up a spark in me though.  The 
following had no problems with multiple reboots:

   #!/bin/sh
   # --
   # Script to rotate /var/log/messages
   # to be run with root privileges
   # ----------
   rm -rf /var/log/messages.old
   mv /var/log/messages /var/log/messages.old
   touch /var/log/messages
   reboot
   
For a quick hack, this works. I think I will keep a
tag on fast growers in the /var/log subdir, and try 
to attack specific files rather than move the whole 
subdirectory.

USM Bish

> 
> On Mon, 4 Sep 2000, USM Bish wrote:
> 
> > 
> > Is there a recommended way wherein I keep the log for the
> > last seven days only, with some process at boot-up or cron ?
> > 
> > USM Bish
> > 

Re: Trimming down of /var/log/messages

[Olaf Meeuwissen]

USM Bish <[EMAIL PROTECTED]> writes:

> With time, the size of /var/log/messages keeps on growing,
> till it really becomes really huge, with information no
> longer needed. Since syslogd is constantly monitoring and writing on to
> it, I have never attempted initialising a fresh /var/log/messages on a
> running machine.
> 
> Is there a recommended way wherein I keep the log for the
> last seven days only, with some process at boot-up or cron ?

Seems like logrotate will fit your bill.

  Package: logrotate
  Priority: important
  Section: admin
  Conffiles:
   /etc/logrotate.conf 70593fe48cb39133328b42a560b5a8cf
  Description: Log rotation utility
   The logrotate utility is designed to simplify the administration of
   log files on a system which generates a lot of log files.
   Logrotate allows for the automatic rotation compression, removal
   and mailing of log files.  Logrotate can be set to handle a log
   file daily, weekly, monthly or when the log file gets to a certain
   size.  Normally, logrotate runs as a daily cron job.

-- 
Olaf Meeuwissen   Epson Kowa Corporation, Research and Development

Re: Trimming down of /var/log/messages

[Alvin Oga]

hi ya

make sure cron is runningit already rotates log files
weekly/monthly... at least on the 1u raid5 debian box
i poke around in

if you want to manually rotate your logs

kill syslogd or sysklogdthan move it aside...
but you must also kill things like the web server
too that logs stuff into /var/log/httpd/ and more stuff to retart

simple silly way...that will always work...
- mv /var/log /var/log.old ; mkdir /var/log
- reboot
- and it should all be cleaned up by itself

- if you want to preserve uptime"init 1" instead of reboot
  move the files around...than "init 3" or whatever level you want

c ya
alvin

On Mon, 4 Sep 2000, USM Bish wrote:

> With time, the size of /var/log/messages keeps on growing,
> till it really becomes really huge, with information no
> longer needed. Since syslogd is constantly monitoring and writing on to
> it, I have never attempted initialising a fresh /var/log/messages on a
> running machine.
> 
> Is there a recommended way wherein I keep the log for the
> last seven days only, with some process at boot-up or cron ?
> 
> USM Bish
> 
> 
> 
> -- 
> Unsubscribe?  mail -s unsubscribe [EMAIL PROTECTED] < /dev/null
> 

Trimming down of /var/log/messages

[USM Bish]

With time, the size of /var/log/messages keeps on growing,
till it really becomes really huge, with information no
longer needed. Since syslogd is constantly monitoring and writing on to
it, I have never attempted initialising a fresh /var/log/messages on a
running machine.

Is there a recommended way wherein I keep the log for the
last seven days only, with some process at boot-up or cron ?

USM Bish

Re: strange /var/log/messages

[Chris Gray]

On Mon, Sep 04, 2000 at 02:10:58AM +0200, Danny Pansters wrote:
> On Mon, 04 Sep 2000, William Jensen wrote:
> > Anyone have any idea what this is:
> >
> > Sep  3 17:17:30 stimpy -- MARK --
> > Sep  3 17:37:30 stimpy -- MARK --
> > Sep  3 17:57:30 stimpy -- MARK --
> > Sep  3 18:17:30 stimpy -- MARK --
> > Sep  3 18:37:30 stimpy -- MARK --
> >
> > I see those all day long.
> 
> I have those too, I don't believe they mean anything bad is going on, but I 
> also would like to know what exactly this is.
> 
> I always thought it were kernel messages relating to memory swapping or 
> network checks or something.

They simply mean that the system is OK at the moment.  This information
could be useful in finding out when a system was last alive before it
crashed.  (Notice that they happen once every 20 minutes)

Cheers,
Chris

-- 
pick, pack, pock, puck: like drops of water in a fountain falling
softly in the brimming bowl.

Re: strange /var/log/messages

[iehrenwald]

> > Sep  3 17:37:30 stimpy -- MARK --

Those are from syslogd.  I think it defaults to every 20 minutes making a
-- MARK -- in the logs.  I occasionally find them useful for finding out
an aprox. time when an even occured.  The interval can be changed with the
-m arg.

Ian Ehrenwald

Re: strange /var/log/messages

[Danny Pansters]

On Mon, 04 Sep 2000, William Jensen wrote:
> Anyone have any idea what this is:
>
> Sep  3 17:17:30 stimpy -- MARK --
> Sep  3 17:37:30 stimpy -- MARK --
> Sep  3 17:57:30 stimpy -- MARK --
> Sep  3 18:17:30 stimpy -- MARK --
> Sep  3 18:37:30 stimpy -- MARK --
>
> I see those all day long.

-- 

I have those too, I don't believe they mean anything bad is going on, but I 
also would like to know what exactly this is.

I always thought it were kernel messages relating to memory swapping or 
network checks or something.

Thanks,


Danny Pansters
[EMAIL PROTECTED]
www.ricin.com

strange /var/log/messages

[William Jensen]

Anyone have any idea what this is:

Sep  3 17:17:30 stimpy -- MARK --
Sep  3 17:37:30 stimpy -- MARK --
Sep  3 17:57:30 stimpy -- MARK --
Sep  3 18:17:30 stimpy -- MARK --
Sep  3 18:37:30 stimpy -- MARK --

I see those all day long.

Re: access to /var/log/messages

[John Galt]

Have you considered uncommenting the "log to ttyv" line in syslog.conf,
then you don't need to play around with perms?  If you MUST elevate user
privs, try "sudo" first rather than making your user GID 0--you can gain
all the functionality you need, but don't open yourself to another
compromisable "800 pound gorilla account".


On Fri, 1 Sep 2000, William Jensen wrote:

> Greetings Debians,
> 
> I'd like to give access to the directory /var/log/messages to my user account
> so I can watch what messages are being displayed there.  I'd do this with tail
> -f /var/log/messages.  Problem is my user accnt has no permissions on that
> directory.  I could change the permissions on the directory itself but then
> any other user can look into that data and I'd rather not have that.
> Therefore is it wise policy to add my user account to the 'root' group?  Would
> that solve the problem while maintaining system security?  Or is there a
> better way of achieving this?  And how would I go about adding myself to the
> root group...modify /etc/group?
> 
> Thanks,
> 
> Bill
> 
> 
> 

-- 
There is an old saying that if a million monkeys typed on a million 
keyboards for a million years, eventually all the works of Shakespeare
would be produced.   Now, thanks to Usenet, we know this is not true.

Who is John Galt?  [EMAIL PROTECTED], that's who!

Re: access to /var/log/messages

[Kai Weber]

+ William Jensen <[EMAIL PROTECTED]>:

> Therefore is it wise policy to add my user account to the 'root' group?  Would
> that solve the problem while maintaining system security?  Or is there a
> better way of achieving this?  And how would I go about adding myself to the
> root group...modify /etc/group?

As you can see most of the files in /var/log have the permissions for
root and the adm group set. 

[ bond : ~ ] ls -l /var/log/messages
-rw-r-1 root adm        105000 Sep  2 01:19 /var/log/messages

Adding a user to the root group is not a good idea. Ok, if it is your
machine at home and you are the only user it could be ok. But I
recommend you to add you to the groups you need access to: 

adduser  

Groups I belong to are: adm, cdrom, audio, dip and video.

Kai.
-- 
+ mailto:[EMAIL PROTECTED] + http://www.tu-ilmenau.de/~bond/

access to /var/log/messages

[Peter Firmstone]

William,

The  command you need is usermod, add the administrator  (adm) group to
your user:

$ usermod -g [ your main group] -G adm, [other groups you may want to
add separated by commas]

Your can learn more information about groups and suchlike by looking at
the howto's in the /usr/doc/ directory.

Cheers,

Peter Firmstone.

Re: access to /var/log/messages

[Eric G . Miller]

On Fri, Sep 01, 2000 at 02:05:47PM -0500, William Jensen wrote:
> Greetings Debians,
> 
> I'd like to give access to the directory /var/log/messages to my user
> account so I can watch what messages are being displayed there.  I'd
> do this with tail -f /var/log/messages.  Problem is my user accnt has
> no permissions on that directory.  I could change the permissions on
> the directory itself but then any other user can look into that data
> and I'd rather not have that.  Therefore is it wise policy to add my
> user account to the 'root' group?  Would that solve the problem while
> maintaining system security?  Or is there a better way of achieving
> this?  And how would I go about adding myself to the root
> group...modify /etc/group?

Methinks,

$ adduser  adm

will do the trick.  Not too sure if it doesn't give too much away.  Alot
of things seem to have read priveledges for the adm group
(/dev/xconsole, /var/log/messages, ...).  I guess this is the purpose of
this group.  Wouldn't add just anyone to it.

-- 
/bin/sh ~/.signature:
Command not found

Re: Followup: access to /var/log/messages

[Andrew Sullivan]

On Fri, Sep 01, 2000 at 02:49:05PM -0500, William Jensen wrote:

> I used adduser  adm and it worked like a charm.  My question is why
> does it work?  The folder /var/log is owned by root and has root group.  Why
> does adm have rights to that...how does that all fit together?

If you do 
$ls -l /var/

You'll see (among other things)

drwxr-xr-x   16 root root 4096 Sep  1 07:59 log

So, /var/log/ is a directory, user root can read, write, and execute
everything in it, and group root and all others on the system can
read and execute everything in it.  _But_

        $ls -l /var/log/messages

gets you

-rw-r-1 root adm 78711 Sep  1 15:52 /var/log/messages

which tells you that user root can read and write to this file, and
anyone in the group adm can _read_ the file.  No-one else can read
it, either.

A
-- 
Andrew Sullivan  Computer Services
<[EMAIL PROTECTED]>Burlington Public Library
+1 905 639 3611 x158   2331 New Street
   Burlington, Ontario, Canada L7R 1J4

Followup: access to /var/log/messages

[William Jensen]

I usually add myself to the adm group.  That way, I get access to the
file /var/log/messages.  You can use either adduser or usermod
utilities.  The latter can mess thigs up if you don't list your
groups carefully -- read the man pages.

Andrew,

I used adduser  adm and it worked like a charm.  My question is why
does it work?  The folder /var/log is owned by root and has root group.  Why
does adm have rights to that...how does that all fit together?

Bill

access to /var/log/messages

[William Jensen]

Greetings Debians,

I'd like to give access to the directory /var/log/messages to my user account
so I can watch what messages are being displayed there.  I'd do this with tail
-f /var/log/messages.  Problem is my user accnt has no permissions on that
directory.  I could change the permissions on the directory itself but then
any other user can look into that data and I'd rather not have that.
Therefore is it wise policy to add my user account to the 'root' group?  Would
that solve the problem while maintaining system security?  Or is there a
better way of achieving this?  And how would I go about adding myself to the
root group...modify /etc/group?

Thanks,

Bill

Re: offtopic: placing items in /var/log/messages...

[Pierfrancesco Caci]

:-> "Jonathan" == Jonathan Lupa <[EMAIL PROTECTED]> writes:

> Not really debian related, but is there either a shell function or a
> perl function to put a line into /var/log/messages? (there must be- I
> just can't find it)...

    > Or is it open( LOG, ">/var/log/messages" ); for me? :) (just a joke).

"logger" is your friend here :-)

Pf


-- 

---
 Pierfrancesco Caci  |   mailto:[EMAIL PROTECTED] - http://gusp.infogroup.it
  ik5pvx - Firenze   | Office for the Complication of Otherwise Simple Affairs 
 Linux penny 2.3.35 #1 Wed Dec 29 16:09:39 CET 1999 i686 unknown

offtopic: placing items in /var/log/messages...

[Jonathan Lupa]

Not really debian related, but is there either a shell function or a
perl function to put a line into /var/log/messages? (there must be- I
just can't find it)...

Or is it open( LOG, ">/var/log/messages" ); for me? :) (just a joke).

Thanks!
Jonathan
-- 
[EMAIL PROTECTED]
GPG public key available from http://www.jamdata.net/~jjlupa/gpg.asc



pgpFnkq931M19.pgp
Description: PGP signature

/var/log/messages

[Dave Wiard]

could somebody clue me in to what this is?  it's all over in my
/var/log/messages..

Oct 26 23:59:37 morpheus kernel: set_program_attributes(1200
 d8a000 1400 466740) 

Dave Wiard

Re: tail -f /var/log/messages and top

[Stephan Engelke]

Hi Patrick,

On Wed, Jul 28, 1999 at 04:02:43PM +0100, Patrick Kirk wrote:
> Thanks for the answers on this.  It seems the top problem is due to the NT
> telnet client.  Could someone recommend a decent telnet client for NT.  It
> needs to be something that the techies at work won't be horrified by which
> usually means a proper uninstall routine for when I move offices.

Add something like this to your /etc/profile, ~/.bashrc, or .profile:

8<-8<--
# correct terminal settings if connecting from Nice Try
if [ "$TERM" == "ansi" ]
then
TERM="vt100"
export TERM
fi
->8->8-

Works like a charm and is probably the easiest sollution as far as
maintainance goes.   This is the solution we chose for you entire
department.
This sollution has the advantage of coming with the most widely
distributed uninstall solution of all times: "use your favourite text
editor". :-)

So long, Stephan
-- 
Stephan Engelke[EMAIL PROTECTED]
   *** If only women came with pulldown menus and online help. ***

Re: tail -f /var/log/messages and top

[Patrick Kirk]

Thanks for the answers on this.  It seems the top problem is due to the NT
telnet client.  Could someone recommend a decent telnet client for NT.  It
needs to be something that the techies at work won't be horrified by which
usually means a proper uninstall routine for when I move offices.

Patrick

Re: tail -f /var/log/messages and top

[Carl Mummert]

You can try setting the TERM environment variable to match your
terminal; this is definitely needed from the awful windows
telnet program.

If you don't know which ones to try, try 'vt100' or 'vt220'.

Carl

Re: tail -f /var/log/messages and top

[markus]

Hi Patrick,

as Stephan told, the "MARK"s are written by syslogd.
top needs the "right" tty settings to work, because it uses 
control characters to refresh what it is displaying.
I guess you invoked it in a somewhat misbehaving telnet 
session (maybe on a Windows machine).
It should work in an xterm or at least at the console.
If you need it in your telnet, you have probably to tune
this tty (from inside) with the "stty" command , so this is 
maybe the FM you should R (I never did this myself, sorry).

Markus



  
Markus Stausberg
InfoLytics AG
Marktstrasse 8
50968 Koeln
Germany

Re: tail -f /var/log/messages and top

[Stephan Engelke]

Hi Patrick,

On Wed, Jul 28, 1999 at 10:26:43AM +0100, Patrick Kirk wrote:

> enterprise:/home/patrick# tail -f /var/log/messages
> Jul 28 07:14:11 enterprise -- MARK --
[ ... lots of marks removed ... ]

This is syslogd's way of telling you that it's still alive (you don't
have to feed it, though.)  Another place to look for error messages
would be /var/log/syslog, if you are using the default
syslong.conf-file.

Take a look at this file, maybe you need to customize it a little to
see more messages or maybe the messages you want are written to a
different file.

I don't know what might cause your top problem.

> I'm having problems with dropped connections and would like to be able to
> use these commands.  If this is a RTFM, please do let me know which FM to R.

PPP usually writes to /var/log/syslog, some, but not as many of the
daemons's messages are sent to /var/log/messgaes, too.

So long -- Stephan
-- 
Stephan Engelke[EMAIL PROTECTED]
   *** If only women came with pulldown menus and online help. ***

tail -f /var/log/messages and top

[Patrick Kirk]

When I want to see error messages, tail -f /var/log/messages produces
this...am I doing something wrong?

enterprise:/home/patrick# tail -f /var/log/messages
Jul 28 07:14:11 enterprise -- MARK --
Jul 28 07:34:11 enterprise -- MARK --
Jul 28 07:54:10 enterprise -- MARK --
Jul 28 08:14:10 enterprise -- MARK --
Jul 28 08:34:10 enterprise -- MARK --
Jul 28 08:54:10 enterprise -- MARK --
Jul 28 09:14:09 enterprise -- MARK --
Jul 28 09:34:11 enterprise -- MARK --
Jul 28 09:54:10 enterprise -- MARK --
Jul 28 10:14:10 enterprise -- MARK --

Also top shows no processes at all but pstree does:

10:23am  up 10 days, 18:31,  2 users,  load average: 0.09, 0.08, 0.08
37 processes: 36 sleeping, 1 running, 0 zombie, 0 stopped
CPU states:  0.5% user,  0.3% system,  0.0% nice, 99.2% idle
Mem:  127168K av, 121892K used,   5276K free,  16184K shrd,  62020K buff
Swap: 208800K av,   1112K used, 207688K free 44716K cached

  PID USER PRI  NI  SIZE  RSS SHARE STAT  LIB %CPU %MEM   TIME COMMAND

I'm having problems with dropped connections and would like to be able to
use these commands.  If this is a RTFM, please do let me know which FM to R.

Patrick