topic Re: Wrfile on /etc/messages in ONTAP Discussions

Wrfile on /etc/messages

saranraj456 — Fri, 15 Jun 2012 19:17:09 GMT

Hi frndz,

I have wrongly used wrfile on /etc/messages ,now when i am viewing the rdfile /etc/messages is showing empty.How to get the logs back in that folder..?

Regards,

Saran

Re: Wrfile on /etc/messages

scottgelb — Fri, 15 Jun 2012 19:24:09 GMT

You won't be able to recover what was lost (unless in a snapshot) but you can reset syslog and it will start collecting again..saves a reboot

priv set advanced ; syslog reset_syslog

Re: Wrfile on /etc/messages

aborzenkov — Sat, 16 Jun 2012 05:29:21 GMT

From snapshot or backup.

Re: Wrfile on /etc/messages

saranraj456 — Sat, 16 Jun 2012 10:48:14 GMT

The data is not recovered ,because we dont have any snapshot and backup.Just we did a restart of syslog.

Re: Wrfile on /etc/messages

RichardKenyan — Fri, 17 Apr 2015 17:18:19 GMT

@scottgelb wrote:
You won't be able to recover what was lost (unless in a snapshot) but you can reset syslog and it will start collecting again..saves a reboot

priv set advanced ; syslog reset_syslog

Thank you for this command! It really helped me out.

Note to others:

I was on my console, and when I did it, it said "bad syslog.conf line "*.info"

So I looked at another filer syslog.conf I had that was working, copied it, wrote it, and then restarted the syslog again.

This time it worked.

filer_name*> syslog reset_syslog
filer_name*> Fri Apr 17 12:45:33 EDT [syslogd]: logerror syslogd: bad syslog.conf line "*.info"

Fri Apr 17 12:45:33 EDT [syslogd]: logerror syslogd: bad syslog.conf line "*.info"

Fri Apr 17 12:45:33 EDT [syslogd]: logerror syslogd: bad syslog.conf line "*.info"


filer_name*> rdfile /etc/messages
filer_name*> version
NetApp Release 8.2.3 7-Mode: Thu Jan 15 21:30:45 PST 2015

filer_name*> rdfile /etc/syslog.conf
*.info
*.info
*.info

filer_name*> wrfile /etc/syslog.conf
*.info                                  /dev/console
*.info                                  /etc/messages
read: error reading standard input: Interrupted system call

filer_name*> rdfile /etc/syslog.conf
*.info                                  /dev/console
*.info                                  /etc/messages

filer_name*> syslog reset_syslog
filer_name*> Fri Apr 17 13:00:00 EDT [filer_name:kern.uptime.filer:info]:   1:00pm up 32 days, 11:16

Hope this helps somebody.

Re: Wrfile on /etc/messages

mfriedenfeld — Tue, 28 Apr 2015 19:46:01 GMT

That's exactly what I needed Richard. I wonder how those syslog.conf files get wiped out like that? Only major changes I had on this pair was an upgrade to 8.2.3p1 about 2 weeks back.

I didn't do a wite file on my messages file, but about a week ago, my console and messages log files stopped showing data (just noticed today looking for lun reset requests from last night). Your post was right on point to get it working again.

Thanks again!

Re: Wrfile on /etc/messages

rsankuru — Wed, 15 Nov 2017 16:52:19 GMT

It is recommended that all /etc/syslog.conf files include the line.

*.info /etc/messages

*.info /etc/console