Wrfile on /etc/messages

[saranraj456]

Hi frndz,

I have wrongly used wrfile on /etc/messages ,now when i am viewing the rdfile /etc/messages is showing empty.How to get the logs back in that folder..?

Regards,

Saran

[scottgelb · Accepted solution]

You won't be able to recover what was lost (unless in a snapshot) but you can reset syslog and it will start collecting again..saves a reboot

priv set advanced ; syslog reset_syslog

[aborzenkov]

From snapshot or backup.

[saranraj456]

The data is not recovered ,because we dont have any snapshot and backup.Just we did a restart of syslog.

[RichardKenyan]

---

@scottgelb wrote:

You won't be able to recover what was lost (unless in a snapshot) but you can reset syslog and it will start collecting again..saves a reboot

priv set advanced ; syslog reset_syslog

---

Thank you for this command! It really helped me out.

Note to others:

I was on my console, and when I did it, it said "bad syslog.conf line "*.info"

So I looked at another filer syslog.conf I had that was working, copied it, wrote it, and then restarted the syslog again.

This time it worked.

filer_name*> syslog reset_syslog
filer_name*> Fri Apr 17 12:45:33 EDT [syslogd]: logerror syslogd: bad syslog.conf line "*.info"

Fri Apr 17 12:45:33 EDT [syslogd]: logerror syslogd: bad syslog.conf line "*.info"

Fri Apr 17 12:45:33 EDT [syslogd]: logerror syslogd: bad syslog.conf line "*.info"


filer_name*> rdfile /etc/messages
filer_name*> version
NetApp Release 8.2.3 7-Mode: Thu Jan 15 21:30:45 PST 2015

filer_name*> rdfile /etc/syslog.conf
*.info
*.info
*.info

filer_name*> wrfile /etc/syslog.conf
*.info                                  /dev/console
*.info                                  /etc/messages
read: error reading standard input: Interrupted system call

filer_name*> rdfile /etc/syslog.conf
*.info                                  /dev/console
*.info                                  /etc/messages

filer_name*> syslog reset_syslog
filer_name*> Fri Apr 17 13:00:00 EDT [filer_name:kern.uptime.filer:info]:   1:00pm up 32 days, 11:16

Hope this helps somebody.

[mfriedenfeld]

That's exactly what I needed Richard.  I wonder how those syslog.conf files get wiped out like that?  Only major changes I had on this pair was an upgrade to 8.2.3p1 about 2 weeks back.

I didn't do a wite file on my messages file, but about a week ago, my console and messages log files stopped showing data (just noticed today looking for lun reset requests from last night).  Your post was right on point to get it working again.

Thanks again!

[rsankuru]

It is recommended that all /etc/syslog.conf files include the line.

*.info          /etc/messages

*.info          /etc/console