Recreate the Syslem.log?

W

wharring

Registered
I've discovered that my system.log is missing.

Using LogMaster, I find I can access "/var/log/system.log.0" which is a large file whose last entry is:
"Sep 10 10:13:33 William-Harringtons-Computer syslogd: exiting on signal 15."

However, there is no "system.log" in /var/log, which is why, I guess, LogMaster shows it as having no entries.

Anyone know how to recreate the system.log file?
 
Go to the terminal, and type sudo touch /var/log/system.log. That should get things working again.

You might also want to check that syslogd is running still; you can do that by typing in ps -auxc | grep syslogd - if you don't have it printing out a line that has the name syslogd at the end of it, your system logger stopped for some reason. You can get it running again by typing sudo /usr/sbin/syslogd -s -m 0.
 
well, you can restart syslog, which will begin saving log entries now, but anything that's missing is gone forever.

sudo /usr/sbin/syslogd -m 0

will do that.

Note that a very likely reason for syslog to have received a signal 15 (quit) is that someone hacked your computer, and wanted to hide their subsequent actions. Unless you yourself killed the syslog process accidentally, you should probably assume your computer is no longer your own, flatten the whole thing and rebuild it. Any files that you copy over from the old (and now suspect) installation, you might want to run through a virus scanner.
 
Thanks to both of you -- the system.log file is back, though without any entries yet. From the date of the entry telling syslogd to quit, I think that was about the time I had installed "Who's There? for Mac OSX" and ran its script to enable logging. From the ReadMe file:

"If you want to use Who's There? with a firewall that logs to the system log, you should first run the "Enable WT Log" application (in the "WT Utilities" folder) and enter your password into the Terminal application. Doing so creates a special log for Who's There? since the system log is archived frequently and data from it is then unavailable. You only need to run this application once, and you should not run it if using Norton Personal Firewall."

I wasn't running Norton but may have run the app more than once because logging didn't begin right away. Finally got the log running but decided to unistall Who's There? , turn off the built-in firewall and go back NetBarrier X. I guess something along the way deleted the system.log (though I'm not sure how that could be done).

Thanks for your help!
 
Well, nothing need have deleted system.log - the daily maintenance script renames system.log to system.log.0, system.log.0 to system.log.1, and so on. This is to preserve some days worth of log files, without the logs getting too huge.

If syslogd is running correctly then it would create a new one as soon as the first log message happened.

Good to hear there's no problem with a compromised machine.
 
You must log in or register to reply here.
Back
Top