/var/log/messages gone! syslog is running ...

[j***@jsquared.ca]

Hello, I$B!G(Bve been running OpenBSD 3.0 for over a year now and it has
been fantastic. Problem is that all of the sudden, my /var/log/messages
is GONE (find / -name messages as root finds nothing). Needless to say,
it's very hard to diagnose my system, or install new services when I
can't view the errors they generate ... A ps aux returns the following
syslog info:

root 16317 0.0 0.7 100 220 ?? Is Fri01PM 0:01.49
syslogd -a /var/named/dev/log

I have restarted the service and have since rebooted. I$B!G(Bm not sure why
the process is pointing to /var/named/dev.

syslog.conf $B"*(B

# $OpenBSD: syslog.conf,v 1.12 2001/08/23 13:27:52 camield Exp $
#

*.err;kern.debug;auth.notice;authpriv.none;mail.crit /dev/console
*.notice;auth,authpriv,cron,ftp,kern,lpr,mail,user.none
/var/log/messages
kern.debug,user.info,syslog.info
/var/log/messages
auth.info /var/log/authlog
authpriv.debug /var/log/secure
cron.info /var/cron/log
daemon.info /var/log/daemon
ftp.info /var/log/xferlog
lpr.debug
/var/log/lpd-errs
mail.info /var/log/maillog
#uucp.info /var/log/uucp

*.err root
*.notice;auth.debug root
*.alert root
*.emerg *

rc.conf $B"*(B
syslogd_flags="" # add more flags, ie. "-u -a
/chroot/dev/log"

Anyone have ideas?

James Herschel
JSquared Network Solutions
[phone]
***@jsquared.ca

[Saad Kadhi]

Post by j***@jsquared.ca
root 16317 0.0 0.7 100 220 ?? Is Fri01PM 0:01.49
syslogd -a /var/named/dev/log
I have restarted the service and have since rebooted. I?$B!Gm not sure why
the process is pointing to /var/named/dev.

Because named is running in a chroot from /var/named. It sends its logs to
/var/named/dev/log to which syslog listens. These logs are then appended to
files in /var/log by syslog so you can get log information from named.

Just a thought. Did you go to /var/log and looked there with 'ls' to see if
messages has really vanished ? if so, just 'touch /var/log/messages' and there
you go again. You may need to HUP syslog though.

If /var/log/messages has really disappeared and you are sure that there is no
human cluelessness behind it, then it is fairly possible your box got
compromised. Not by a clever cracker though. (hint: have you patched your system
with the latest patches on a regular basis ?)

HTH

// Saad Kadhi