[H-GEN] Lost maillog!

[Jason Parker-Burlingham]

"Tony Melia" <tony.melia at tmitc.com.au> writes:

> I have somehow managed to kill my /var/log/maillog file.  If I try to cat or
> tail it, I get 'cat: /var/log/maillog: No such device or address'.

You've probably got filesystem corruption.  Shut down the system and
force a fsck in single-user mode.  Consider the whole thing a test of
your backups, because you may well need them.

> ls looks like this ; srwxrwx---    1 root     root            0 Mar 22 05:51
> /var/log/maillog

The problem is that "s"; it indicates that the file---and
/var/log/maillog surely should be a file---has become a socket;
usually one finds sockets in /dev or occasionally under /tmp.  Files
changing type like that is a sure sign that the filesystem has become
confused.

Heavy-use files are usually the best candidates for corruption, and
this is a pretty common failure.  The good news is that a fsck will
*probably* fix the damage, but you need to find out why it happened,
or it will happen again.  Has the system been shut down unexpectedly
lately?  Maybe a disk is going bad?

> Sendmail is otherwise working perfectly.  Also nothing in /var/log/messages
> during a restart of sendmail.

I wouldn't expect much in the way of errors; sockets are supposed to
work just like files, so sendmail won't report any error (if indeed
it's trying to open /var/log/maillog).

jason
-- 
http://panix.com/~jasonp?BabyPictures