Date: Sat, 18 Apr 1998 04:53:35 -0700 (PDT) From: "Bryan K. Ogawa" <bkogawa@primenet.com> To: geoffr@globalserve.net Cc: questions@FreeBSD.ORG Subject: Re: Reading Cycled Logs Message-ID: <199804181153.EAA19522@foo.primenet.com> References: <35381CAB.243600D8@globalserve.net>
next in thread | previous in thread | raw e-mail | index | archive | help
In localhost.freebsd.questions you write: >Hi, >I admin a co-hosted server and every few weeks I login to find it has >rebooted. I don't know if its a technical problem, a power failure or >somebody with root privileges from my ISP doing work on it. My problem >is that the last two times its happened the /var/log/messages file had >been cycled before I got to it so I can't find out if it was done by a >user or not. My question is how do I extract the compressed back logs >and how do I determine which log file to decompress? When the messages >log is cycled is it numbered 1 and all the other archived logs moved up >in number so that the last one is deleted or dose it archive them in a >loop. (ie. archives it as messages.1.gz, then messages.2.gz the next >time until it reaches the last number and goes back to messages.1.gs ). >Thanks in advance for any help. By default, the messages file is rotated every Saturday at 3:30 AM. Look at the uptime of your machine (run the uptime command to find it), then determine the time the machine rebooted. Let's say the file that matches the last time the machine was rebooted is /var/log/messages.0.gz Try the following: gzcat /var/log/messages.0.gz | more to view the file in more. Note that my messages are not compressed, just moved, e.g. /var/log/messages.0 -- bryan k ogawa <bkogawa@primenet.com> http://www.primenet.com/~bkogawa/ To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?199804181153.EAA19522>