/var/log/messages is not getting new data.

[David Timms]

Joel Gomberg wrote:
> John DeDourek wrote:
>> David Timms wrote:
>>> Hi, I'm on FC6 machine that gets updated at least once a week. I 
>>> notice today {monday}, that messages has been rotated and is empty so 
>>> far.
>>> -rw------- 1 root root      0 Apr  8 09:07 /var/log/messages
>>> -rw------- 1 root root 326802 Apr  5 07:03 /var/log/messages.1
>>> -rw------- 1 root root 632374 Apr  1 04:05 /var/log/messages.2
>>> -rw------- 1 root root 273450 Mar 25 11:06 /var/log/messages.3
>>> -rw------- 1 root root  89829 Mar 20 18:53 /var/log/messages.4
>>>
>>> Since the machine has been shutdown and rebooted 3/4 times since 
>>> Apr5, it seems that no data is getting to this log. The machine has 
>>> been on for many hours almost every day since (now Apr9). Normally 
>>> yum log items are also logged to messages, but there have been none 
>>> of these in this time frame.
> 
>>> Apr 04 22:21:30 Updated: VMware-server.i386 1.0.2-39867
>>> Apr 04 22:34:16 Updated: VMware-server-console.i386 1.0.2-39867
Frank:
# service syslog status
syslogd (pid 2814) is running...
klogd (pid 2818) is running...

> VMware server updates have the nasty habit of modifying /etc/services 
> and changing its SeLinux context.  Running restorecon /etc/services as 
> root should fix the problem.
# ls -lZ /etc/serv*
-rw-r--r--  root root user_u:object_r:rpm_script_tmp_t /etc/services
# restorecon -v /etc/services
restorecon reset /etc/services context 
user_u:object_r:rpm_script_tmp_t:s0->system_u:object_r:etc_t:s0
# ls -lZ /etc/ser*
-rw-r--r--  root root system_u:object_r:etc_t          /etc/services

So the se context was incorrect. It didn't seem to start logging 
immediately {ie on an ssh login}.

# service syslog restart

And now /var/log/messages is being updated like normal.

Thanks Joel :)

John: Do you have vmware {of some flavour} installed ? (I guess Joel's 
hunch would apply to any of their apps that use an .pl install script).

Since the vmware-server install is from their rpm package, I am going to 
post there:
http://www.vmware.com/community/thread.jspa?messageID=617291

DaveT.