Good News: It is working :)
The problem was my special setup. My /etc/services isnt't on its place. It is on a shared filesystem, which isn't mounted yet at boot time. So the symlink I created from /etc/services to that file was broken. But syslog needed that file to map syslog/udp to a specific portnumber. This wasn't possible so it failed. Well now, it is working just fine :) Thanks for all you help, guys :) Florian > -----Ursprüngliche Nachricht----- > Von: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Im > Auftrag von Schmidt, Florian > Gesendet: Donnerstag, 24. Juli 2008 10:43 > An: Red Hat Enterprise Linux 5 (Tikanga) discussion mailing-list > Betreff: AW: [rhelv5-list] Re: syslog broken? > > > -----Ursprüngliche Nachricht----- > > Von: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] > Im > > Auftrag von Kay Diederichs > > Gesendet: Mittwoch, 23. Juli 2008 19:56 > > An: [email protected] > > Betreff: [rhelv5-list] Re: syslog broken? > > > > Schmidt, Florian schrieb: > > > Hi redhat-guys, > > > > > > On one of my RHEL5-boxes there is no logging anymore via syslog. > > > > > > I do not have a lot of experience with syslog, so I don't really know > > > what to look for. > > > > > > Restarting syslog does not help. > > > In /var/log/messages.1 there is the last message from 17th of July > > > before the box got shut down. Seems that after this event syslog didn't > > > log anymore. > > > > > > File permissions are same as on the other boxes (600 root:root). > > > > > > Can anyone give me hints, what to check and/or how to make it work > > > again? > > > > > > Thanks a lot. > > > Florian > > > > from my experience this is a SELinux problem, due e.g. to booting a > > different kernel that does not have SELinux enabled. The fix is to > > touch /.autorelabel > > and reboot. Or you chase down the specific SELinux problem(s) associated > > with syslogd. > > I followed you instructions, (touched /.autorelabel, an rebooted) but it did > not really > help. Logging still does not work. :( > No messages in /var/log/messages. > > Also in /var/log/boot.log there are no messages. Only dmesg and /var/log/dmesg > show something, but I do not know, if this data is from last reboot or some > days old. > > In /var/log/dmesg I find a lot of lines like this: > > audit(1216886894.867:3): avc: denied { getattr } for pid=1664 > comm="setfiles" > path="/proc/mdstat" dev=proc ino=-268434939 scontext=system_u:system_r:setfil > es_t:s0 tcontext=system_u:object_r:proc_mdstat_t:s0 tclass=file > > I do not know, what this means (is it from autorelabling?), I only read deny > and > auditd and thought it could have something to do with the problem? > > Regards > Florian > > > > > HTH, > > > > Kay > > > > _______________________________________________ > > rhelv5-list mailing list > > [email protected] > > https://www.redhat.com/mailman/listinfo/rhelv5-list > > _______________________________________________ > rhelv5-list mailing list > [email protected] > https://www.redhat.com/mailman/listinfo/rhelv5-list _______________________________________________ rhelv5-list mailing list [email protected] https://www.redhat.com/mailman/listinfo/rhelv5-list
