Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Today, I went to look at a backup RHEL5 server that doesn't usually need to get looked at very often. I found that /var/log/messages existed, but had a size of zero. Similarly, messages.1, messages.2, messages.3, and messages.4 are also all empty.

  • /var/log/messages has its correct permissions. (755)
  • Reboot - No help.
  • rm -f /var/log/messages* and service syslog restart - No help.

What am I missing?

share|improve this question
up vote 1 down vote accepted

I went to look at /etc/syslog.conf. It included the line

*.info;mail.none;authpriv.none;cron.none;local*.none;    /var/log/messages

This might be the problem. This is a backup DNS server, and I set up several local* syslog facilities once to do extra DNS logging. The syslog service might not actually like the local* partial wild card. So, change the line to

*.info;mail.none;authpriv.none;cron.none;local3.none;local4.none;local5.none;local7.none    /var/log/messages

and restart syslog.

Following the restart, /var/log/messages started populating again, and I could get on with solving the mystery that brought me back to this host to begin with...

So, solution: No partial string wildcards in /etc/syslog.conf. The facility is either * or a full string, but not both.

share|improve this answer

I had the same issue under CentOS 6 - /var/log/messages.log was empty, yum install syslog showed "already installed" but when I tried service syslog restart or service syslogd restart it said "unrecognized service". Then I found in /etc/sysconfig/rsyslog and I tried service rsyslog start and bingo! it worked. Now messages.log is populated.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .