Am 23. Apr, 2001 schwäzte Steven M. Klass so:

> 	So this weekend I noticed my log files have mysteriously shifted
> from /var/log/messages to screen 1.  Well I looked at the logs and it
> appears to have happened on friday afternoon.  So, I want to know how
> do I get them back to where they belong.  I think this is a bigge
> problem, because this shouldn't just happen.

Did you change anything on Fri? Update anything? If not, please check the
integrity of your system. Log files don't just suddenly start showing up
somewhere else...

Where they go is determined by /etc/syslog.conf.

> 	As a second question how do you flush a log file correctly, so
> it will start using it.

? Not quite certain what your asking. If you want syslog to start using
the file again make sure there is a correct entry in /etc/syslog.conf and
HUP syslog, e.g. "kill -HUP `cat /var/run/syslogd.pid`". "-HUP" is english
for "-1", e.g. 'HANGUP'.

If the log file appears to be corrupt, then move it out of the way (
retains the info, so you can refer to it later ), create a new file of the
same name with proper perms, then HUP syslog.

-rw-r-----    1 root     adm          2769 23.04 10:31 /var/log/messages

That's on debian. Other dists might prefer a different group and different
perms. Doesn't matter for usability and the security differences are
actualy minor as well.

mv /var/log/messages /var/log/messages.19Apr2001
>/var/log/messages
chmod 0640 /var/log/messages
kill -HUP `cat /var/run/syslogd.pid`

I like to datestamp files I save in the filename, hence the 19Apr2001
tacked on the end of the above.

ciao,

der.hans
-- 
# der.hans@LuftHans.com home.pages.de/~lufthans/ www.Aligo.com
#  I'm not anti-social, I'm pro-individual. - der.hans