Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Today, I went to look at a backup RHEL5 server that doesn't usually need to get looked at very often. I found that /var/log/messages existed, but had a size of zero. Similarly, messages.1, messages.2, messages.3, and messages.4 are also all empty.

  • /var/log/messages has its correct permissions. (755)
  • Reboot - No help.
  • rm -f /var/log/messages* and service syslog restart - No help.

What am I missing?

share|improve this question
up vote 1 down vote accepted

I went to look at /etc/syslog.conf. It included the line

*.info;mail.none;authpriv.none;cron.none;local*.none;    /var/log/messages

This might be the problem. This is a backup DNS server, and I set up several local* syslog facilities once to do extra DNS logging. The syslog service might not actually like the local* partial wild card. So, change the line to

*.info;mail.none;authpriv.none;cron.none;local3.none;local4.none;local5.none;local7.none    /var/log/messages

and restart syslog.

Following the restart, /var/log/messages started populating again, and I could get on with solving the mystery that brought me back to this host to begin with...

So, solution: No partial string wildcards in /etc/syslog.conf. The facility is either * or a full string, but not both.

share|improve this answer

I had the same issue under CentOS 6 - /var/log/messages.log was empty, yum install syslog showed "already installed" but when I tried service syslog restart or service syslogd restart it said "unrecognized service". Then I found in /etc/sysconfig/rsyslog and I tried service rsyslog start and bingo! it worked. Now messages.log is populated.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.