To make debugging an issue easier, I deleted /var/log/messages .... and it hasn't come back!

I thought debug messages from kernel and modules like autofs were routed to this file. But even after I cycle autofs (which is set to verbose logging), this file is gone.

How to recover?


You need to restart your system logger:

service rsyslog restart

(as root).

A reboot would also have the same effect, but it's rather overkill.

Log messages go to a system logger, rsyslog on CentOS, and the logger writes to various files depending on its configuration (or even other loggers on remote systems). rsyslog opens /var/log/messages when it starts, and keeps it open; deleting /var/log/messages makes it disappear from the directory, but the file still exists and is usable by any program which had it open. So rsyslog continues logging to the deleted file... Restarting it causes it to re-open the file, re-creating it first in this case.

  • In my case, on old centos it was service syslog restart ... Feb 25 '19 at 13:40

A reboot would help: the file is opened (creating if it does not exist) at startup, and while you can "see" it with lsof, it's gone from the filesystem until something opens it again.

Once you get your file back, I suggest proving that nothing else opens it by renaming the file. If any other process creates it, you'll see that when it happens.

  • But I have done autofs operations that should get logged there, and the file is not getting created... shouldn't that do it? Oct 16 '16 at 21:40
  • 1
    Apparently not - your messages are written to the deleted file by the ongoing process ;-) Oct 16 '16 at 21:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.