Hi. recently in many of our lpars we are getting a message in errpt as "C6ACA566 0315094014 U S dtc MESSAGE REDIRECTED FROM SYSLOG".
I have also checked the /etc/syslog.conf file. It doesn't point to error log.
Can someone please advise about how to fix this error ?
pmut3:/> errpt -aj C6ACA566 | pg
---------------------------------------------------------------------------
LABEL: SYSLOG
IDENTIFIER: C6ACA566
Date/Time: Sat 15 Mar 09:40:24 2014
Sequence Number: 131800
Machine Id: 00C806F04C00
Node Id: pmut3
Class: S
Type: UNKN
Resource Name: dtc
Description
MESSAGE REDIRECTED FROM SYSLOG
User Causes
OPERATOR REDIRECTED SYSLOG MESSAGES TO ERROR LOG
Recommended Actions
REVIEW DETAILED DATA
Detail Data
SYSLOG MESSAGE
dtc: NOTICE:Dynamic activation: stopped capturing IO of block major device: 35.
pmut3:/> cat /etc/syslog.conf | grep -i err
# emerg/panic,alert,crit,err(or),warn(ing),notice,info,debug
Can you show us all the active entries in syslog.conf please. There may be a *.debug or other level that also captures these messages. Something like:-
cut -f1 -d "#" /etc/syslog.conf | grep -v "^$"
.... should give us the active information stripping out the comments.
Thanks, in advance,
Robin
Just now checked. Seems all the lines are commented in the server.
pmut3:/> cat /etc/syslog.conf
# @(#)34 1.11 src/bos/etc/syslog/syslog.conf, cmdnet, bos530 4/27/04 14:47:53
# IBM_PROLOG_BEGIN_TAG
# This is an automatically generated prolog.
#
# bos530 src/bos/etc/syslog/syslog.conf 1.11
#
# Licensed Materials - Property of IBM
#
# (C) COPYRIGHT International Business Machines Corp. 1988,1989
# All Rights Reserved
#
# US Government Users Restricted Rights - Use, duplication or
# disclosure restricted by GSA ADP Schedule Contract with IBM Corp.
#
# IBM_PROLOG_END_TAG
#
# COMPONENT_NAME: (CMDNET) Network commands.
#
# FUNCTIONS:
#
# ORIGINS: 27
#
# (C) COPYRIGHT International Business Machines Corp. 1988, 1989
# All Rights Reserved
# Licensed Materials - Property of IBM
#
# US Government Users Restricted Rights - Use, duplication or
# disclosure restricted by GSA ADP Schedule Contract with IBM Corp.
#
# /etc/syslog.conf - control output of syslogd
#
#
# Each line must consist of two parts:-
#
# 1) A selector to determine the message priorities to which the
# line applies
# 2) An action.
#
# Each line can contain an optional part:-
#
# 3) Rotation.
#
# The fields must be separated by one or more tabs or spaces.
#
# format:
#
# <msg_src_list> <destination> [rotate [size <size> k|m] [files <files>] [time <time> h|d|w|m|y] [compress] [archive <archive>]]
#
# where <msg_src_list> is a semicolon separated list of <facility>.<priority>
# where:
#
# <facility> is:
# * - all (except mark)
# mark - time marks
# kern,user,mail,daemon, auth,... (see syslogd(AIX Commands Reference))
#
# <priority> is one of (from high to low):
# emerg/panic,alert,crit,err(or),warn(ing),notice,info,debug
# (meaning all messages of this priority or higher)
#
# <destination> is:
# /filename - log to this file
# username[,username2...] - write to user(s)
# @hostname - send to syslogd on this machine
# * - send to all logged in users
#
# [rotate [size <size> k|m] [files <files>] [time <time> h|d|w|m|y] [compress] [archive <archive>]] is:
# If <destination> is a regular file and the word "rotate" is
# specified, then the <destination> is limited by either
# <size> or <time>, or both <size> and <time>. The <size> causes
# the <destination> to be limited to <size>, with <files> files
# kept in the rotation. The <time> causes the <destination> to be rotated after
# <time>. If both <time> and <size> are specified then logfiles
# will be rotated once the the logfile size exceeds the <size>
# or after <time>, whichever is earlier. The rotated filenames
# are created by appending a period and a number to <destination>,
# starting with ".0".
#
# If compress option is specified then the logfile names will be
# generated with a ".Z" extension. The files keyword will be applicable
# to the logfiles which are currently under rotation. For example
# if we specify the compress option then only fileis with ".Z" extension
# will be under rotation and number of such files will be limited by
# <files> files. Any logfiles with an extension other than ".Z"
# will not be under the rotation scheme and thus will not be within
# the limit of <files> files. Similarly if we remove the compress
# option then the files which have been generated with ".Z" extension
# will no longer be the part of rotation scheme and will not be limited
# by the <files> files.
#
# The minimum size that can be specified is 10k, the minimum
# number of files that can be specified is 2. The default
# size is 1m (meg) and the default for <files> is unlimited.
# Therefore, if only "rotate" is specified, the log will be
# rotated with <size> = 1m.
# The compress option means that rotated log files that are not
# in use will be compressed.
# The archive option will save rotated log files that are not
# in use to <archive>.
# The default is not to rotate log files.
#
# example:
# "mail messages, at debug or higher, go to Log file. File must exist."
# "all facilities, at debug and higher, go to console"
# "all facilities, at crit or higher, go to all users"
# mail.debug /usr/spool/mqueue/syslog
# *.debug /dev/console
# *.crit *
# *.debug /tmp/syslog.out rotate size 100k files 4
# *.crit /tmp/syslog.out rotate time 1d
Did you take a look at the running syslogd process to make sure it's not configured to point to an alternate configuration (-f) file?
ps -elf | grep yslog
Below is the output:
pmut3:/> ps -elf | grep syslog
240001 A root 372980 217198 0 60 20 58269480 340 12 Mar - 0:00 /usr/sbin/syslogd