Centos – Not seeing kernel messages in syslog

centoskernelsyslog

I'm trying to track down a process that kills my mysql server on my CentOS box.

I have the following setting in /etc/syslog.conf:

*.*;mail.none;authpriv.none;cron.none /var/log/messages

I assume that this should cause all messages (including kernel messages) to be logged to /var/log/messages, except for authpriv, mail and cron messages.

Yet, when I view /var/log/messages, I don't see any kernel messages that appear to be killing the server.

Here are the full contents of the /etc/syslog.conf file:

# Log anything (except mail) 
# Don't log private authentication messages!
*.*;mail.none;authpriv.none;cron.none           /var/log/messages

# The authpriv file has restricted access.
authpriv.*                                              /var/log/secure

# Log all the mail messages in one place.
mail.*                                                  -/var/log/maillog

# Log cron stuff
cron.*                                                  /var/log/cron

# Everybody gets emergency messages
*.emerg                                                 *

# Save news errors of level crit and higher in a special file.
uucp,news.crit                                          /var/log/spooler

# Save boot messages also to boot.log
local7.*                                                /var/log/boot.log

I have restarted syslog, but it makes no difference.

Any ideas?

Best Answer

Without going into speculation on your crashes, I can help with syslog.

*.*;mail.none;authpriv.none;cron.none           /var/log/messages

You dont need to list any facilities or priorities if you use asterisks. This is purely pedantic, but just an fyi. If you really want all messages going to /var/log/messages, you would use:

*.* /var/log/messages

Ensure that you are actually running "syslog" rather than "rsyslog". The config you are quoting is based on the usage of the older "syslog" that was default in CentOS 5 and earlier. You don't mention which version of CentOS you are on, but if that happens to be CentOS 6, then you are likely running rsyslog. Rsyslog uses /etc/rsyslog.conf and /etc/rsyslog.d/*.conf Both of those can not be running at the same time or you may not see messages. The first one to bind to the syslog port will win.

To test syslog for kernel messages, use the following:

 logger -i -p kern.crit "This is a syslog test"

If you see your test message, then syslog is working and mysqld is crashing on it's own, as lsmooth mentioned.

Related Topic