ONTAP Discussions

Wrfile on /etc/messages

saranraj456
7,994 Views

Hi frndz,

I have wrongly used wrfile on /etc/messages ,now when i am viewing the rdfile /etc/messages is showing empty.How to get the logs back in that folder..?

Regards,

Saran

1 ACCEPTED SOLUTION

scottgelb
7,797 Views

You won't be able to recover what was lost (unless in a snapshot) but you can reset syslog and it will start collecting again..saves a reboot

priv set advanced ; syslog reset_syslog

View solution in original post

6 REPLIES 6

scottgelb
7,798 Views

You won't be able to recover what was lost (unless in a snapshot) but you can reset syslog and it will start collecting again..saves a reboot

priv set advanced ; syslog reset_syslog

RichardKenyan
7,362 Views

@scottgelb wrote:

You won't be able to recover what was lost (unless in a snapshot) but you can reset syslog and it will start collecting again..saves a reboot

 

priv set advanced ; syslog reset_syslog


Thank you for this command! It really helped me out.

 

Note to others:

I was on my console, and when I did it, it said "bad syslog.conf line "*.info"

 

So I looked at another filer syslog.conf I had that was working, copied it, wrote it, and then restarted the syslog again.

This time it worked.

filer_name*> syslog reset_syslog
filer_name*> Fri Apr 17 12:45:33 EDT [syslogd]: logerror syslogd: bad syslog.conf line "*.info"

Fri Apr 17 12:45:33 EDT [syslogd]: logerror syslogd: bad syslog.conf line "*.info"

Fri Apr 17 12:45:33 EDT [syslogd]: logerror syslogd: bad syslog.conf line "*.info"


filer_name*> rdfile /etc/messages
filer_name*> version
NetApp Release 8.2.3 7-Mode: Thu Jan 15 21:30:45 PST 2015

filer_name*> rdfile /etc/syslog.conf
*.info
*.info
*.info

filer_name*> wrfile /etc/syslog.conf
*.info                                  /dev/console
*.info                                  /etc/messages
read: error reading standard input: Interrupted system call

filer_name*> rdfile /etc/syslog.conf
*.info                                  /dev/console
*.info                                  /etc/messages

filer_name*> syslog reset_syslog
filer_name*> Fri Apr 17 13:00:00 EDT [filer_name:kern.uptime.filer:info]:   1:00pm up 32 days, 11:16

 

Hope this helps somebody.

mfriedenfeld
7,298 Views

That's exactly what I needed Richard.  I wonder how those syslog.conf files get wiped out like that?  Only major changes I had on this pair was an upgrade to 8.2.3p1 about 2 weeks back.

 

I didn't do a wite file on my messages file, but about a week ago, my console and messages log files stopped showing data (just noticed today looking for lun reset requests from last night).  Your post was right on point to get it working again.

 

Thanks again!

rsankuru
5,436 Views

 

It is recommended that all /etc/syslog.conf files include the line.

*.info          /etc/messages

*.info          /etc/console

 

aborzenkov
7,797 Views

From snapshot or backup.

saranraj456
7,797 Views

The data is not recovered ,because we dont have any snapshot and backup.Just we did a restart of syslog.

Public