Log Analysis

Ø  /var/log/messages   --Read the log file first

Ø  If no information, follow below

#ls –lt  /var/log/         --its shows the last modified with the newest at the top

#ls –lrt /var/log/        --Use –r flag to reverse the ordering, i.e. newest at the bottom

Ø  dmesg

ü  kernel log buffer can be read by using the “dmesg”

ü  the size of this buffer is 128 KB in RHEL5

ü  the oldest log messages are dropped once the buffer fills up

ü  During boot process, the log buffer is saved to /var/log/dmesg near the end of the “rc.sysinit” script

ü  Otherwise, kernel messages will generally be logged to /var/log/messages (by klogd service)

Additional Information Gathering

Ø  Increase logging information

ü  Often when trying to debug problems it’s helpful to be able to increase the verbosity of output or logging

ü  Example, cups printing system, changing the “Loglevel Info” to “Loglevel Debug” in /etc/cups/cupsd.conf

ü  It will vastly increase the information logged under /var/log/cups

Ø  Verbose flags

ü  -v,-vv,-vvv

ü  --help