Thread: Logwatch Get Actual Log File Location / Name

I've inherited maintenance on a linux system that has logwatch on it. In its report it's giving the following bit:

--------------------- Kernel Begin ------------------------

WARNING: Kernel Errors Present
SCSI Error: (0:0:0) Status=...: 3Time(s)

---------------------- Kernel End -------------------------

What log does that error originate from? It doesn't seem to be the 'messages' log.

Check /var/log/messages file.

I don't see anything in 'messages' obviously correlates. These are the items for yesterday:

May 3 02:33:00 mybox su(pam_unix)[13743]: session opened for user user1 by (uid=0)
May 3 02:33:00 mybox su(pam_unix)[13743]: session closed for user user1
May 3 04:02:08 mybox kernel: smb_request: result -104, setting invalid
May 3 04:02:08 mybox kernel: smb_retry: successful, new pid=2180, generation=312
May 3 04:02:08 mybox kernel: smb_request: result -104, setting invalid
May 3 04:02:08 mybox kernel: smb_retry: successful, new pid=2184, generation=326
May 3 04:03:09 mybox logrotate: ALERT exited abnormally with [1]
May 3 08:59:59 mybox Retrospect[2133]: OpenJavaMessage: RETROSPECT_HOME not defined
May 3 13:34:20 mybox sshd(pam_unix)[17065]: session opened for user user2 by (uid=515)
May 3 13:46:09 mybox sshd(pam_unix)[17065]: session closed for user user2
May 3 16:17:44 mybox sshd(pam_unix)[17942]: session opened for user user2 by (uid=515)
May 3 16:18:34 mybox su(pam_unix)[17982]: session opened for user root by user2(uid=515)
May 3 16:24:45 mybox kernel: smb_request: result -104, setting invalid
May 3 16:24:45 mybox kernel: smb_retry: successful, new pid=2180, generation=313
May 3 16:24:45 mybox kernel: smb_request: result -104, setting invalid
May 3 16:24:45 mybox kernel: smb_retry: successful, new pid=2184, generation=327
May 3 18:43:38 mybox sshd(pam_unix)[17942]: session closed for user user2
May 3 18:43:38 mybox su(pam_unix)[17982]: session closed for user root

and logwatch is reporting again

--------------------- Kernel Begin ------------------------

WARNING: Kernel Errors Present
SCSI Error: (0:0:0) Status=...: 3Time(s)

---------------------- Kernel End -------------------------

Any other possibilities where that could be coming from??

Try greping into /var/log/ directory:

Code:

cd /var/log
egrep -iR 'SCSI Error:' *
zgrep -iR 'SCSI Error:' *

The above will search for archived and current log files for the errors. What kind of SCSI system you've have installed? Some SCSI devices comes with java based monitoring tools which can provide more data. There are other tools that can find out SCSI subsystem errors too.

Aha! I was looking at the most recent entries in 'messages', which seems reasonable, BUT it's a large file (29Mb) and the errors seem to be from May 3 at some point in the past (probably 2 years ago). Since the log doesn't track the year, logwatch picks up the old entries.

I suppose I'll just backup and delete the log. Thanks much!