Other logfile turned over due to size 100k

Hello guys,

running the command:

tail -f /var/log/messages,

I received the message:

logfile turned over due to size>100k.

Please, can you help me to fix this problem ?

Thanks in advance.
 
As chrbr says, it is not a problem, it is by design.

The real question is: Why is your log file so huge that it needs to be turned over? Usually, it means that something is logging a lot. Which probably means that something is wrong, or else that something isn't right :)
 
Dear ralphbsz,
if the machine is not operated 24/7 the start up messages are enough to fill up /var/log/messages. At least it is the situation here. In my latest rotated logs I see 5x shutdown. If the machine is just kept running I agree to you.
 
Yes guys !

I've understood. Thanks very much !

However, my question was: is there a command to purge the "messages" ring buffer when this error appears ?
(after rebooting, I've used tail -f /var/log/messages without problems).

Probably I've not well understood what newsyslog.conf(5) asserts.

Bye !!!
Thanks a lot !!
 
Logfile rotation means that the old logfile does not exist anymore, and instead a new one having another inode but the same filename is created. That said, you need to restart the tail process. One way to do this automatically, would be to supervise the tail command using the daemon(8) utility like so:
daemon -r -p /var/run/messages_tail.pid tail -f /var/log/massages

Then in file /etc/syslog.conf you would add to the line starting with /var/log/messages a directive to send SIGHUP to the process owning the /var/run/messages_tail.pid file. This would stop the current tail process and the daemon daemon would restart it because of the -r flag.
Code:
...
/var/log/messages    644   5 100 @0101T JC    /var/run/messages_tail.pid    SIGHUP
...
 
Looking at tail(8), I see a way much easier option, then supervising tail with the daemon utility.
Code:
...
     -F      The -F option implies the -f option, but tail will also check to
             see if the file being followed has been renamed or rotated.  The
             file is closed and reopened when tail detects that the filename
             being read from has a new inode number.

             If the file being followed does not (yet) exist or if it is
             removed, tail will keep looking and will display the file from
             the beginning if and when it is created.

             The -F option is the same as the -f option if reading from
             standard input rather than a file.
...
 
Hello Obsigna,

I'll give a look at your tips ... surely I can learn more !!!

Thanks very much.

Bye !
 
Use tail -F /var/log/messages. The -F instead of -f will re-open the file if it gets rotated away.
 
Back
Top