Hi Andrei,
So:
root@pf:~# ps aux | grep rsyslog
root 11250 0.8 3.3 872116 274200 ? Ssl 15:37 2:26
/usr/sbin/rsyslogd -n
root 23873 0.0 0.0 12780 968 pts/0 S+ 20:25 0:00 grep rsyslog
root@pf:~# service rsyslog stop
root@pf:~# ps aux | grep rsyslog
root 23909 0.0 0.0 12780 1020 pts/0 S+ 20:25 0:00 grep rsyslog
root@pf:~# rm -f /usr/local/pf/logs/*
root@pf9:~# lsof | grep /usr/local/pf/logs
snmptrapd 23941 root 3w REG 8,1
23 67605574 /usr/local/pf/logs/snmptrapd.log
and yes: the file snmptrapd.log is the exception, all other files (20,
25 of them) are gone, remain gone, and are not listed in lsof as open.
Then, when starting rsyslog again, this time in debug mode ("rsyslogd
-dn") it shows that it IS in fact writing those logs:
5849.717653159:main Q:Reg/w0 : omfile: write to stream, pData->pStrm
0x7fccf403be50, lenBuf 383, strt data Dec 6 16:22:56 pf9 pfconfig: pfconfig(709)
ERROR: [mac:[undef]] Caught error DBI
connect('database=pf;host=localhost;port=3306'
5849.717657173:main Q:Reg/w0 : omfile: write to stream, pData->pStrm
0x7fccf403be50, lenBuf 289, strt data Dec 6 16:22:56 pf9 pfconfig: pfconfig(709)
ERROR: [mac:[undef]] Couldn't connect to MySQL database to access L2. This is a
majo
5849.717661550:main Q:Reg/w0 : omfile: write to stream, pData->pStrm
0x7fccf403be50, lenBuf 99, strt data Dec 6 16:22:56 pf9 pfconfig: Could not write
namespace FilterEngine::SwitchScopes() to L2 cache !
5849.717665624:main Q:Reg/w0 : omfile: write to stream, pData->pStrm
0x7fccf403be50, lenBuf 170, strt data Dec 6 16:22:56 pf9 pfconfig: pfconfig(709)
ERROR: [mac:[undef]] Could not write namespace FilterEngine::SwitchScopes() to L2
ca
5849.717669576:main Q:Reg/w0 : omfile: write to stream, pData->pStrm
0x7fccf403be50, lenBuf 383, strt data Dec 6 16:22:56 pf9 pfconfig: pfconfig(709)
ERROR: [mac:[undef]] Caught error DBI
connect('database=pf;host=localhost;port=3306'
5849.717697926:main Q:Reg/w0 : omfile: write to stream, pData->pStrm
0x7fccf403be50, lenBuf 289, strt data Dec 6 16:22:56 pf9 pfconfig: pfconfig(709)
ERROR: [mac:[undef]] Couldn't connect to MySQL database to access L2. This is a
majo
5849.717702051:main Q:Reg/w0 : omfile: write to stream, pData->pStrm
0x7fccf403be50, lenBuf 383, strt data Dec 6 16:22:56 pf9 pfconfig: pfconfig(709)
ERROR: [mac:[undef]] Caught error DBI
connect('database=pf;host=localhost;port=3306'
As you can see from the lines above: these are old log lines from Dec 6.
I also see non-packetfence lines, so this is not specific for the
packetfence install, sample:
5860.210336266:main Q:Reg/w0 : omfile: write to stream, pData->pStrm
0x7fcd0c007dd0, lenBuf 95, strt data Dec 6 16:31:31 pf9 kernel: SGI XFS with
ACLs, security attributes, realtime, no debug enabled
5860.210339962:main Q:Reg/w0 : omfile: write to stream, pData->pStrm
0x7fcd0c007dd0, lenBuf 63, strt data Dec 6 16:31:31 pf9 kernel: XFS (sda1):
Mounting V5 Filesystem
5860.210343827:main Q:Reg/w0 : omfile: write to stream, pData->pStrm
0x7fcd0c007dd0, lenBuf 87, strt data Dec 6 16:31:31 pf9 kernel: usb 1-1: new
full-speed USB device number 2 using uhci_hcd
5860.210347393:main Q:Reg/w0 : omfile: write to stream, pData->pStrm
0x7fcd0c007dd0, lenBuf 77, strt data Dec 6 16:31:31 pf9 kernel: XFS (sda1):
Starting recovery (logdev: internal)
The date and time on the system is correct. The system has been rebooted
repeatedly.
Anyone who can explain?
MJ
