logfetch.status on Darwin clients

7 messages in this thread

list Dominique Frise · Fri, 28 Apr 2006 12:41:19 +0200 ·

Hi,

On Darwin clients logfetch.status never get updated (shows 0 bytes) and thus alert messages never get expired:

-----clientdata------
[msgs:/var/log/system.log]
Apr 28 03:15:01 zelda2 cp: error processing extended attributes: Operation not permitted
Apr 28 03:15:01 zelda2 cp: error processing extended attributes: Operation not permitted
Apr 28 03:15:01 zelda2 cp: error processing extended attributes: Operation not permitted
Apr 28 06:17:13 zelda2 sudo:       bb : TTY=unknown ; PWD=/Users/bb ; USER=root ; COMMAND=/sbin/shutdown -H
Apr 28 08:13:21 zelda2 su: bb to root on /dev/ttyp1
Apr 28 08:14:02 zelda2 sudo:       bb : TTY=ttyp1 ; PWD=/Users/bb ; USER=root ; COMMAND=/sbin/SystemStarter stop BB
Apr 28 08:15:36 zelda2 su: bb to root on /dev/ttyp1
Apr 28 08:16:08 zelda2 sudo:       bb : TTY=ttyp1 ; PWD=/soft/pub/BB/hobbit/client/ext ; USER=root ; COMMAND=/sbin/SystemStarter stop BB
Apr 28 08:16:08 zelda2 SystemStarter[3131]: "/Library/StartupItems/BB/BB" failed security check: not owned by UID 0
Apr 28 08:16:08 zelda2 SystemStarter[3131]: "/Library/StartupItems/BB/BB" failed security check: not owned by GID 0
Apr 28 08:16:08 zelda2 SystemStarter[3131]: Unknown service: BB
Apr 28 08:16:12 zelda2 sudo:       bb : TTY=ttyp1 ; PWD=/soft/pub/BB/hobbit/client/ext ; USER=root ; COMMAND=/sbin/SystemStarter stop BB
Apr 28 08:16:12 zelda2 SystemStarter[3132]: "/Library/StartupItems/BB/BB" failed security check: not owned by UID 0
Apr 28 08:16:12 zelda2 SystemStarter[3132]: "/Library/StartupItems/BB/BB" failed security check: not owned by GID 0
Apr 28 08:16:12 zelda2 SystemStarter[3132]: Unknown service: BB
Apr 28 08:16:18 zelda2 sudo:       bb : TTY=ttyp1 ; PWD=/soft/pub/BB/hobbit/client/ext ; USER=root ; COMMAND=/sbin/SystemStarter start BB
Apr 28 08:16:18 zelda2 SystemStarter[3133]: "/Library/StartupItems/BB/BB" failed security check: not owned by UID 0
Apr 28 08:16:18 zelda2 SystemStarter[3133]: "/Library/StartupItems/BB/BB" failed security check: not owned by GID 0
Apr 28 08:16:18 zelda2 SystemStarter[3133]: Unknown service: BB
Apr 28 08:16:37 zelda2 sudo:       bb : TTY=ttyp1 ; PWD=/soft/pub/BB/hobbit/client/ext ; USER=root ; COMMAND=/sbin/SystemStarter -d start BB
Apr 28 08:16:37 zelda2 SystemStarter[3137]: "/Library/StartupItems/BB/BB" failed security check: not owned by UID 0
Apr 28 08:16:37 zelda2 SystemStarter[3137]: "/Library/StartupItems/BB/BB" failed security check: not owned by GID 0
Apr 28 08:16:37 zelda2 SystemStarter[3137]: Unknown service: BB
Apr 28 08:20:49 zelda2 su: pam_authenticate: Authentication failure
Apr 28 08:20:55 zelda2 su: bb to root on /dev/ttyp1
Apr 28 08:21:27 zelda2 SystemStarter[3154]: "/Library/StartupItems/BB/BB" failed security check: not owned by UID 0
Apr 28 08:21:27 zelda2 SystemStarter[3154]: "/Library/StartupItems/BB/BB" failed security check: not owned by GID 0
Apr 28 08:21:27 zelda2 SystemStarter[3154]: Unknown service: BB
Apr 28 08:22:56 zelda2 sudo:       bb : TTY=ttyp1 ; PWD=/soft/pub/BB/hobbit/client/ext ; USER=root ; COMMAND=/sbin/SystemStarter start BB
Apr 28 08:24:12 zelda2 sudo:       bb : TTY=ttyp1 ; PWD=/soft/pub/BB/hobbit/client/tmp ; USER=root ; COMMAND=/sbin/SystemStarter restart BB
Apr 28 08:57:20 zelda2 su: bb to root on /dev/ttyp1

[logfile:/var/log/system.log]
type:100000 (file)
mode:640 (-rw-r-----)
linkcount:1
owner:0 (root)
group:80 (admin)
size:3
clock:1146219697 (2006/04/28-12:21:37)
atime:1146219697 (2006/04/28-12:21:37)
ctime:1146207446 (2006/04/28-08:57:26)
mtime:1146207446 (2006/04/28-08:57:26)


zelda:/soft/pub/BB/hobbit/client/tmp bb$ ls -la
total 80
drwxr-xr-x  5 bb  ci    170 28 Apr 12:28 .
drwxr-xr-x  9 bb  ci    306 27 Apr 09:10 ..
-rw-r--r--  1 bb  ci     63 28 Apr 12:28 logfetch.cfg
-rw-r--r--  1 bb  ci     34 28 Apr 12:28 logfetch.status
-rw-r--r--  1 bb  ci  29495 28 Apr 12:28 msg.txt


zelda:/soft/pub/BB/hobbit/client/tmp bb$ cat logfetch.status
/var/log/system.log:0:0:0:0:0:0:0


zelda:/soft/pub/BB/hobbit/client/logs bb$ wc /var/log/system.log
      349    2847   47437 /var/log/system.log


hobbitclient.log is empty.

Where could be the problem?

Dominique
UNIL - University of Lausanne

list Henrik Størner · Fri, 28 Apr 2006 13:40:12 +0200 ·

▸ quoted from Dominique Frise

On Fri, Apr 28, 2006 at 12:41:19PM +0200, Dominique Frise wrote:

On Darwin clients logfetch.status never get updated (shows 0 bytes) and 
thus alert messages never get expired:

[logfile:/var/log/system.log]
type:100000 (file)
mode:640 (-rw-r-----)
linkcount:1
owner:0 (root)
group:80 (admin)
size:3
clock:1146219697 (2006/04/28-12:21:37)
atime:1146219697 (2006/04/28-12:21:37)
ctime:1146207446 (2006/04/28-08:57:26)
mtime:1146207446 (2006/04/28-08:57:26)

What does an "ls -l /var/log/system.log" say ?

The info here claims that file is 3 bytes long.

zelda:/soft/pub/BB/hobbit/client/logs bb$ wc /var/log/system.log
     349    2847   47437 /var/log/system.log

But the "wc" output here says it's 47.437 bytes long.


Henrik

list Dominique Frise · Fri, 28 Apr 2006 13:50:05 +0200 ·

▸ quoted from Henrik Størner

Henrik Stoerner wrote:

On Fri, Apr 28, 2006 at 12:41:19PM +0200, Dominique Frise wrote:

On Darwin clients logfetch.status never get updated (shows 0 bytes) and thus alert messages never get expired:

[logfile:/var/log/system.log]
type:100000 (file)
mode:640 (-rw-r-----)
linkcount:1
owner:0 (root)
group:80 (admin)
size:3
clock:1146219697 (2006/04/28-12:21:37)
atime:1146219697 (2006/04/28-12:21:37)
ctime:1146207446 (2006/04/28-08:57:26)
mtime:1146207446 (2006/04/28-08:57:26)


What does an "ls -l /var/log/system.log" say ?

The info here claims that file is 3 bytes long.

zelda:/soft/pub/BB/hobbit/client/logs bb$ wc /var/log/system.log
    349    2847   47437 /var/log/system.log


But the "wc" output here says it's 47.437 bytes long.


Henrik

Updated data:

▸ quoted from Dominique Frise


[msgs:/var/log/system.log]
Apr 28 03:15:01 zelda2 cp: error processing extended attributes: Operation not permitted
Apr 28 03:15:01 zelda2 cp: error processing extended attributes: Operation not permitted
Apr 28 03:15:01 zelda2 cp: error processing extended attributes: Operation not permitted
Apr 28 06:17:13 zelda2 sudo:       bb : TTY=unknown ; PWD=/Users/bb ; USER=root ; COMMAND=/sbin/shutdown -H
Apr 28 08:13:21 zelda2 su: bb to root on /dev/ttyp1
Apr 28 08:14:02 zelda2 sudo:       bb : TTY=ttyp1 ; PWD=/Users/bb ; USER=root ; COMMAND=/sbin/SystemStarter stop BB
Apr 28 08:15:36 zelda2 su: bb to root on /dev/ttyp1
Apr 28 08:16:08 zelda2 sudo:       bb : TTY=ttyp1 ; PWD=/soft/pub/BB/hobbit/client/ext ; USER=root ; COMMAND=/sbin/SystemStarter stop BB
Apr 28 08:16:08 zelda2 SystemStarter[3131]: "/Library/StartupItems/BB/BB" failed security check: not owned by UID 0
Apr 28 08:16:08 zelda2 SystemStarter[3131]: "/Library/StartupItems/BB/BB" failed security check: not owned by GID 0
Apr 28 08:16:08 zelda2 SystemStarter[3131]: Unknown service: BB
Apr 28 08:16:12 zelda2 sudo:       bb : TTY=ttyp1 ; PWD=/soft/pub/BB/hobbit/client/ext ; USER=root ; COMMAND=/sbin/SystemStarter stop BB
Apr 28 08:16:12 zelda2 SystemStarter[3132]: "/Library/StartupItems/BB/BB" failed security check: not owned by UID 0
Apr 28 08:16:12 zelda2 SystemStarter[3132]: "/Library/StartupItems/BB/BB" failed security check: not owned by GID 0
Apr 28 08:16:12 zelda2 SystemStarter[3132]: Unknown service: BB
Apr 28 08:16:18 zelda2 sudo:       bb : TTY=ttyp1 ; PWD=/soft/pub/BB/hobbit/client/ext ; USER=root ; COMMAND=/sbin/SystemStarter start BB
Apr 28 08:16:18 zelda2 SystemStarter[3133]: "/Library/StartupItems/BB/BB" failed security check: not owned by UID 0
Apr 28 08:16:18 zelda2 SystemStarter[3133]: "/Library/StartupItems/BB/BB" failed security check: not owned by GID 0
Apr 28 08:16:18 zelda2 SystemStarter[3133]: Unknown service: BB
Apr 28 08:16:37 zelda2 sudo:       bb : TTY=ttyp1 ; PWD=/soft/pub/BB/hobbit/client/ext ; USER=root ; COMMAND=/sbin/SystemStarter -d start BB
Apr 28 08:16:37 zelda2 SystemStarter[3137]: "/Library/StartupItems/BB/BB" failed security check: not owned by UID 0
Apr 28 08:16:37 zelda2 SystemStarter[3137]: "/Library/StartupItems/BB/BB" failed security check: not owned by GID 0
Apr 28 08:16:37 zelda2 SystemStarter[3137]: Unknown service: BB
Apr 28 08:20:49 zelda2 su: pam_authenticate: Authentication failure
Apr 28 08:20:55 zelda2 su: bb to root on /dev/ttyp1
Apr 28 08:21:27 zelda2 SystemStarter[3154]: "/Library/StartupItems/BB/BB" failed security check: not owned by UID 0
Apr 28 08:21:27 zelda2 SystemStarter[3154]: "/Library/StartupItems/BB/BB" failed security check: not owned by GID 0
Apr 28 08:21:27 zelda2 SystemStarter[3154]: Unknown service: BB
Apr 28 08:22:56 zelda2 sudo:       bb : TTY=ttyp1 ; PWD=/soft/pub/BB/hobbit/client/ext ; USER=root ; COMMAND=/sbin/SystemStarter start BB
Apr 28 08:24:12 zelda2 sudo:       bb : TTY=ttyp1 ; PWD=/soft/pub/BB/hobbit/client/tmp ; USER=root ; COMMAND=/sbin/SystemStarter restart BB
Apr 28 08:57:20 zelda2 su: bb to root on /dev/ttyp1

[logfile:/var/log/system.log]
type:100000 (file)
mode:640 (-rw-r-----)
linkcount:1
owner:0 (root)
group:80 (admin)
size:3


clock:1146224838 (2006/04/28-13:47:18)
atime:1146224838 (2006/04/28-13:47:18)
ctime:1146207446 (2006/04/28-08:57:26)
mtime:1146207446 (2006/04/28-08:57:26)


zelda2:~ bb$ ls -l /var/log/system.log
-rw-r-----   1 root  admin  3078 Apr 28 08:57 /var/log/system.log


zelda2:~ bb$ wc /var/log/system.log
       31     392    3078 /var/log/system.log


zelda2:/soft/pub/BB/hobbit/client/tmp bb$ ll
total 64
-rw-r--r--   1 bb  ci     63 Apr 28 13:47 logfetch.cfg
-rw-r--r--   1 bb  ci     34 Apr 28 13:47 logfetch.status
-rw-r--r--   1 bb  ci  21312 Apr 28 13:47 msg.txt
zelda2:/soft/pub/BB/hobbit/client/tmp bb$ cat logfetch.status
/var/log/system.log:0:0:0:0:0:0:0


The bb user which is running hobbit is also in the admin group:

zelda2:/soft/pub/BB/hobbit/client/tmp bb$ id
uid=2021(bb) gid=10010(ci) groups=10010(ci), 80(admin)


Thanks,

Dominique
UNIL - University of Lausanne

list Henrik Størner · Fri, 28 Apr 2006 15:29:40 +0200 ·

▸ quoted from Dominique Frise

On Fri, Apr 28, 2006 at 01:50:05PM +0200, Dominique Frise wrote:

[logfile:/var/log/system.log]
type:100000 (file)
mode:640 (-rw-r-----)
linkcount:1
owner:0 (root)
group:80 (admin)
size:3

zelda2:~ bb$ ls -l /var/log/system.log
-rw-r-----   1 root  admin  3078 Apr 28 08:57 /var/log/system.log

This is bizarre. Just to make sure I'm not crazy, could you compile the
attached little program and run it on the client reporting this:

   gcc -o stat stat.c
   ./stat /var/log/system.log


Henrik

Attachments (1)

attachment.c application/octet-stream · 1.1 KB

list Dominique Frise · Fri, 28 Apr 2006 15:38:32 +0200 ·

▸ quoted from Henrik Størner

Henrik Stoerner wrote:

On Fri, Apr 28, 2006 at 01:50:05PM +0200, Dominique Frise wrote:

[logfile:/var/log/system.log]
type:100000 (file)
mode:640 (-rw-r-----)
linkcount:1
owner:0 (root)
group:80 (admin)
size:3

zelda2:~ bb$ ls -l /var/log/system.log
-rw-r-----   1 root  admin  3078 Apr 28 08:57 /var/log/system.log


This is bizarre. Just to make sure I'm not crazy, could you compile the
attached little program and run it on the client reporting this:

   gcc -o stat stat.c
   ./stat /var/log/system.log


Henrik


#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <stdio.h>
#include <stdlib.h>
#include <time.h>
#include <string.h>
#include <errno.h>

int main(int argc, char *argv[])
{
	int i;
	struct stat st;
	int fd;

	for (i=1; (i<argc); i++) {
		if (stat(argv[i], &st) == 0) {
			printf("stat OK\n");
			printf("- st_size = %u\n", st.st_size);
			printf("- st_size = %u\n", st.st_size);
			printf("- st_blocks = %u\n", st.st_blocks);
			printf("- st_blksize = %u\n", st.st_blksize);
			printf("- st_mtime = %u %s\n", st.st_mtime, asctime(localtime(&st.st_mtime)));
		}
		else printf("stat failed: %s\n", strerror(errno));

		fd = open(argv[i], O_RDONLY);
		if ((fd >= 0) && (fstat(fd, &st) == 0)) {
			printf("fstat OK\n");
			printf("- st_size = %u\n", st.st_size);
			printf("- st_size = %u\n", st.st_size);
			printf("- st_blocks = %u\n", st.st_blocks);
			printf("- st_blksize = %u\n", st.st_blksize);
			printf("- st_mtime = %u %s\n", st.st_mtime, asctime(localtime(&st.st_mtime)));
		}
		else printf("fstat failed: %s\n", strerror(errno));
	}

	return 0;
}

zelda2:~ bb$ ./stat /var/log/system.log
stat OK
- st_size = 0
- st_size = 0
- st_blocks = 0
- st_blksize = 4096
- st_mtime = 1146207446 Fri Apr 28 08:57:26 2006

fstat OK
- st_size = 0
- st_size = 0
- st_blocks = 0
- st_blksize = 4096
- st_mtime = 1146207446 Fri Apr 28 08:57:26 2006


Dominique

list Henrik Størner · Mon, 29 May 2006 23:11:20 +0200 ·

Could you check if there are still problems with the logfile
handling in the current snapshot ?

If there is, I'd really like to have access to a Darwin-based
system because I have absolutely no idea how it can behave the
way it appears to do.


Regards,
Henrik

list Dominique Frise · Tue, 30 May 2006 07:38:04 +0200 ·

▸ quoted from Henrik Størner

Henrik Stoerner wrote:

Could you check if there are still problems with the logfile
handling in the current snapshot ?

If there is, I'd really like to have access to a Darwin-based
system because I have absolutely no idea how it can behave the
way it appears to do.


Regards,
Henrik

Seems OK since our latest server/client upgrade with snapshot of 16 may.

Thanks,
Dominique

logfetch.status on Darwin clients 🔗 link

logfetch.status on Darwin clients