Results 1 to 5 of 5

Thread: Logwatch Get Actual Log File Location / Name

  1. #1
    Junior Member
    Join Date
    May 2010
    Posts
    3
    Thanks
    1
    Thanked 0 Times in 0 Posts
    Rep Power
    0

    Question Logwatch Get Actual Log File Location / Name

    I've inherited maintenance on a linux system that has logwatch on it. In its report it's giving the following bit:
    --------------------- Kernel Begin ------------------------

    WARNING: Kernel Errors Present
    SCSI Error: (0:0:0) Status=...: 3Time(s)

    ---------------------- Kernel End -------------------------
    What log does that error originate from? It doesn't seem to be the 'messages' log.

  2. #2
    Never say die nixcraft's Avatar
    Join Date
    Jan 2005
    Location
    BIOS
    Posts
    4,513
    Thanks
    17
    Thanked 807 Times in 511 Posts
    Rep Power
    10

    Default

    Check /var/log/messages file.
    All [Solved] threads are closed by mods / admin to avoid spam issues. See Howto mark a thread as [Solved]


  3. #3
    Junior Member
    Join Date
    May 2010
    Posts
    3
    Thanks
    1
    Thanked 0 Times in 0 Posts
    Rep Power
    0

    Default

    I don't see anything in 'messages' obviously correlates. These are the items for yesterday:
    May 3 02:33:00 mybox su(pam_unix)[13743]: session opened for user user1 by (uid=0)
    May 3 02:33:00 mybox su(pam_unix)[13743]: session closed for user user1
    May 3 04:02:08 mybox kernel: smb_request: result -104, setting invalid
    May 3 04:02:08 mybox kernel: smb_retry: successful, new pid=2180, generation=312
    May 3 04:02:08 mybox kernel: smb_request: result -104, setting invalid
    May 3 04:02:08 mybox kernel: smb_retry: successful, new pid=2184, generation=326
    May 3 04:03:09 mybox logrotate: ALERT exited abnormally with [1]
    May 3 08:59:59 mybox Retrospect[2133]: OpenJavaMessage: RETROSPECT_HOME not defined
    May 3 13:34:20 mybox sshd(pam_unix)[17065]: session opened for user user2 by (uid=515)
    May 3 13:46:09 mybox sshd(pam_unix)[17065]: session closed for user user2
    May 3 16:17:44 mybox sshd(pam_unix)[17942]: session opened for user user2 by (uid=515)
    May 3 16:18:34 mybox su(pam_unix)[17982]: session opened for user root by user2(uid=515)
    May 3 16:24:45 mybox kernel: smb_request: result -104, setting invalid
    May 3 16:24:45 mybox kernel: smb_retry: successful, new pid=2180, generation=313
    May 3 16:24:45 mybox kernel: smb_request: result -104, setting invalid
    May 3 16:24:45 mybox kernel: smb_retry: successful, new pid=2184, generation=327
    May 3 18:43:38 mybox sshd(pam_unix)[17942]: session closed for user user2
    May 3 18:43:38 mybox su(pam_unix)[17982]: session closed for user root
    and logwatch is reporting again
    --------------------- Kernel Begin ------------------------

    WARNING: Kernel Errors Present
    SCSI Error: (0:0:0) Status=...: 3Time(s)

    ---------------------- Kernel End -------------------------
    Any other possibilities where that could be coming from??

  4. #4
    Never say die nixcraft's Avatar
    Join Date
    Jan 2005
    Location
    BIOS
    Posts
    4,513
    Thanks
    17
    Thanked 807 Times in 511 Posts
    Rep Power
    10

    Default

    Try greping into /var/log/ directory:
    Code:
    cd /var/log
    egrep -iR 'SCSI Error:' *
    zgrep -iR 'SCSI Error:' *
    The above will search for archived and current log files for the errors. What kind of SCSI system you've have installed? Some SCSI devices comes with java based monitoring tools which can provide more data. There are other tools that can find out SCSI subsystem errors too.
    All [Solved] threads are closed by mods / admin to avoid spam issues. See Howto mark a thread as [Solved]


  5. The Following User Says Thank You to nixcraft For This Useful Post:

    eflat (4th May 2010)

  6. #5
    Junior Member
    Join Date
    May 2010
    Posts
    3
    Thanks
    1
    Thanked 0 Times in 0 Posts
    Rep Power
    0

    Default

    Aha! I was looking at the most recent entries in 'messages', which seems reasonable, BUT it's a large file (29Mb) and the errors seem to be from May 3 at some point in the past (probably 2 years ago). Since the log doesn't track the year, logwatch picks up the old entries.

    I suppose I'll just backup and delete the log. Thanks much!

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Similar Threads

  1. FTP to particular location
    By devi_vi in forum Shell scripting
    Replies: 2
    Last Post: 1st March 2010, 05:45 PM
  2. Device Location
    By Ben Gone in forum Linux hardware
    Replies: 1
    Last Post: 24th February 2010, 04:40 PM
  3. Replies: 5
    Last Post: 14th December 2009, 02:29 PM
  4. access file from remote location and save it
    By asim.mcp in forum Shell scripting
    Replies: 1
    Last Post: 29th September 2009, 12:30 AM
  5. logwatch httpd
    By kavi2 in forum Linux software
    Replies: 3
    Last Post: 22nd September 2005, 09:28 PM

Tags for this Thread

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •