[ILUG] Empty logs

[Kenn Humborg]

On Thu, Jun 15, 2000 at 09:43:50AM +0100, Brian Galbraith wrote:
> Hi Folks
> 
> Last night I was playing around with the firewall on my box at home.
> 
> Previously I had the standard SuSE firewall ip-chains packet filter
> running, linked to ppp0. All activities were duly recorded in both
> /var/log/firewall, and /var/log/messages. I emptied both, as the files were
> quite large.
> 
> Last night I ran the SuSE harden script. I had a friend run a scan on my
> system, and he described it as being "tight", however when I check both
> these logs.....they are empty.

Did you restart syslogd?  If not, then syslogd is still appending to files
that have been deleted (i.e. they still exist on the disk, but don't have
a directory entry, so can't be located).

To truncate your logs, do one of these:

   # cat /dev/null >> /var/log/messages

or 

   # rm /var/log/messages
   # kill -HUP `cat /var/run/syslogd.pid`

If you want to keep the previous logs, do

# mv /var/log/messages /var/log/messages.old
# kill -HUP `cat /var/run/syslogd.pid`

Or use the logrotate package (comes with Red Hat).  Don't know if SuSE
offer something similar.

Later,
Kenn