UNSOLVED
system logger troubles
I just recently installed a new linux server RHEL4.5 and moved the legato env over to it. We are on
Networker 7.3.2 build 386 with this box. All settings are basically the same just a new install of RH and the networker rpms ..
Problem is I'm getting nothing in /nsr/logs/messages This really stinks.. We send savegroup completion notices to a printer so we do have some notification happening .. but old RHEL3 used to log to /nsr/logs/messagess as well. Wierd ness is /nsr/logs/daemon.log is fine and every time I move a tape etc. I see it in the logs.
This could be very well a more OS related logger issue but I thought I'd check here if anyone has seen this before. System use selinux (which is a pain in itself) but I think I have quelled the AVC messages
Networker 7.3.2 build 386 with this box. All settings are basically the same just a new install of RH and the networker rpms ..
Problem is I'm getting nothing in /nsr/logs/messages This really stinks.. We send savegroup completion notices to a printer so we do have some notification happening .. but old RHEL3 used to log to /nsr/logs/messagess as well. Wierd ness is /nsr/logs/daemon.log is fine and every time I move a tape etc. I see it in the logs.
This could be very well a more OS related logger issue but I thought I'd check here if anyone has seen this before. System use selinux (which is a pain in itself) but I think I have quelled the AVC messages
- Yea, syslog.conf looks normal. This was inserted by the rpm upon install of networker
# NetWorker - DO NOT DELETE OR CHANGE THIS LINE
daemon.notice /dev/console
daemon.notice /nsr/logs/messages
daemon.notice operator
local0.notice /nsr/logs/summary
local0.alert root, operator
# NetWorker - DO NOT DELETE OR CHANGE THIS LINE - I have seen only Reverse DNS lookup errors in my log files on RHEL4.5, so I think I can relate. However, the /var/log/messages files complains about avc: denied read and write errors between syslog and /nsr/logs dir. AVC (Access Vector Cache) is part of SELinux.
Below is from messages:
Dec 9 04:02:07 myhost kernel: audit(1197201727.256:1916): avc: denied { write } for pid=3389 comm="syslogd" name="logs"
dev=sda10 ino=95915 scontext=user_u:system_r:syslogd_t tcontext=root:object_r:root_t tclass=dir
It could be as simple as making /nsr/logs as changing the security context from SELinux.
type ll -Z /nsr and look at the permissions.
ll -Z
drwxrwxrwx root root root:object_r:root_t applogs
drwx------ root root root:object_r:root_t cores
drwxr-xr-x root root system_u:object_r:default_t logs
drwxr-xr-x root root root:object_r:root_t res
drwxr-xr-x root root root:object_r:root_t run
drwxr-xr-x root root root:object_r:root_t tmp
chcon -c --reference=/nsr/applogs /nsr/logs
context of /nsr/logs changed to root:object_r:root_t - I'm on a contract and have seen this also in my short tenure. SELinux is a pain but it's best work with it. I just ran restorecon /nsr/logs/daemon.log and the results of running ls -Z both before and after are as follows:
-rw-r--r-- root root root:object_r:etc_runtime_t daemon.log
[root@cvlx15 logs]# restorecon /nsr/logs/daemon.log
[root@cvlx15 logs]# ll -Z
-rw-r--r-- root root system_u:object_r:default_t daemon.log
If this fixes the logging issue I'll report back. I'm no SELinux guru but if someone else is feel free to make another suggestion.
ble1
6 Operator
•
14354 Posts
•
56186 Points
820
0
Posted July 18th, 2007 13:00