log interview questions

Top 15 log interview questions

Exim PanicLog has Non-Zero Size...?

I'm getting the following error from my Ubuntu server:

exim paniclog /var/log/exim4/paniclog on (my server FQDN) has non-zero size, mail system might be broken.

I found a solution on the web here. Basically, I just need erase the paniclog by entering the following code:

sudo rm /var/log/exim4/paniclog

So, I know how to get rid of the error, but I don't know how it started, and how to not let it happen again. Any explanation? Thanks in advance.

Source: (StackOverflow)

Ubuntu: Can I delete /var/log files due to low root space

Just had the message:

Low disk space.. 2 GB left

Judging by a posted message on ubuntu.org forums, I found that I have a .log file in /var/log at 22 GB in size!! My root is an 82 GB partion and Disk Analyser shows the offender to be in log. The system root was installed circa 8 months ago, so clearly this is not a good thing in creating a 22 GB log on an 82 GB root partition.

Is it safe to delete the log file or please advise on the correct safe procedure to cleanse it without messing up my system. I presume it may be ok, but would like some other opinions before I do the task of delete.

Source: (StackOverflow)

Log SSH activity

All, I have an Ubuntu host that accepts SSH connections. How can I log all commands that are run on a specific account that logs in via SSH?


Source: (StackOverflow)

How to view results of last clamscan scan?

I scanned pen drive using clamscan and I closed the terminal after scanning without reading the result.

Now one of my folders on the pen drive is missing. I wanted to know if clamav deleted it.

So I want to view the last scan result.

Source: (StackOverflow)

Redirect UFW logs to own file?

Is there a way I can easily redirect the entries for UFW to their own log file at /var/log/ufw instead of filling up /var/log/syslog as it's becoming tricky to find solutions to problems with all this UFW stuff flying past me?

Source: (StackOverflow)

When an application crash without output an error, is there a log that i can check?

Sometimes it happen that some application crash without give no output error (conky in my case, probably is one of my configuration that is incorrect).

Is there somewhere a error log that I can check to understand why it is crashed?

Source: (StackOverflow)

Can I look at the upgrade log after a distribution upgrade?

I've upgraded to Ubuntu 12.04 and did it offline using the alternative CD. I didn't look at the "packages to remove" section before clicking next - I've done Ubuntu upgrades many times and assumed it was just the normal set of obsolete library packages etc. But I do tend to watch the terminal text go by and see what it's doing, and I saw it removing a number of packages I wanted. I guess these are packages that aren't on the CD that can't co-exist with the new Ubuntu.

Anyway, I want to find which packages have been removed. So does the update log get saved somewhere?

Then I can start doing some grepping on it and then reinstall the packages I did want.

Source: (StackOverflow)

No more boot logging since 16.04?

I noticed that my /var/log/boot.log file has date 2016-04-22, last time I booted in 15.10. Where are Xenial boot.log files located?

Source: (StackOverflow)

How can I read NotifyOSD messages after they are displayed?

I'd like to read a list of messages displayed by notify-osd from time to time. I'm using 12.04 still, if it matters. Is this possible?

These two questions from 2010 indicate that a log file should exist at ~/.cache/notify-osd.log. I have no such file, and I'd like to know if this is a bug (in which case this question should be closed) or if this log file depends on another setting (like System Settings -> Privacy)?

I don't care about storing data between reboots. I just want to browse messages from the current session.

EDIT: Two good answers now but I'd like to know if these messages are stored anywhere, (total guess, /tmp? RAM?) for a short period after appearing on the screen. Some sort of buffer must exist as they appear one after another, a few seconds each, even if there are 20-30 notifications over the span of a minute or two.

I failed to mention in my original question that I'm not interested in yet another PPA + indicator or excessive drive writes, I just want to know if it is possible to see the messages for a short time after they appear.

My use case for this is to go back and find what song was played a few minutes ago on a streaming radio station. I have it on as background music, and occasionally a tune sticks in my head after I hear it. I have no way of going back to see what played 1-2 songs ago.

Source: (StackOverflow)

Where is Xserver log file located?

My Ubuntu 10.10 sometimes totally freezes. I suppose that it is somehow related to my graphic card and would like to check Xserver log. Where is this file located ?

Source: (StackOverflow)

Way to measure computer usage via screensaver active/not active time?

I'm looking for a simple way to determine the rough amount of time per day I spend on a computer. This can be a difficult task if you try to monitor processes, key presses, mouse clicks and the like, because one can be doing anything from thinking about a coding problem, reading a web article, talking on the phone, or gone off walking the dog. The computer cannot read my mind. Since I leave computers on 24/7 monitoring log-ins won't work.

I hit on the idea of logging how much time the computer spends in screensaver mode. My error would then be no greater than the product of the idle-time-to-screensaver with the number of times it goes into screensaver mode. Subtracting this from 24 hours would give me an estimate which would be reasonable for my purposes.

The problem is: I don't know how to log when the screensaver turns on and off. I am running Ubuntu 10.10 at the moment on most machines, about to start upgrading to 11.04 on some of them.

Any ideas?

[edit] After more googling I hit upon the dbus-monitor which looked like it might work, but is missing an important ingredient. Here's the script I am running which launches the monitor as a daemon:

RUNNING=`ps -A | grep "dbus-monitor"`
if [ ! $RUNNING  ]; then
    echo "(Re)starting dbus-monitor daemon"
    nohup dbus-monitor "--profile" "type='signal',interface='org.gnome.ScreenSaver'" >> ${HOME}/sc.log &

Here is the output it produces after locking and unlocking the screen a couple times:

sig     1304860712      153829  2       /org/freedesktop/DBus   org.freedesktop.DBus    NameAcquired
sig     1304860717      318732  462     /org/gnome/ScreenSaver  org.gnome.ScreenSaver   ActiveChanged
sig     1304860725      547928  463     /org/gnome/ScreenSaver  org.gnome.ScreenSaver   ActiveChanged
sig     1304861018      17      464     /org/gnome/ScreenSaver  org.gnome.ScreenSaver   ActiveChanged
sig     1304862919      403523  466     /org/gnome/ScreenSaver  org.gnome.ScreenSaver   ActiveChanged

The second column is obviously unix UTC in seconds. The missing ingredient is it doesn't identify whether the screensaver is on or off! I suppose I could assume they toggle from the time NameAcquired happens, but it makes me queasy that there might be a missing or extra event I can't anticipate which would throw everything out of sync.

Much obliged for ideas.


Source: (StackOverflow)

Where are the NetworkManager logs?

A previous poster on the regular forums ( http://ubuntuforums.org/showthread.php?t=843991 ) said /var/log/daemon.log, but I don't seem to have such a file. Do I need to enable logging?

Source: (StackOverflow)

How do I check if last shutdown was clean?

How can tell that my last shutdown was properly done in Ubuntu 11.10 or if the machine was powered off before shutting down the OS?

Source: (StackOverflow)

Does Ubuntu log when USB devices are connected?

When I connect a USB drive to an Ubuntu OS, would there be a text file which contains details of that connection and if so, where is that file located ? What is the name of that file?

Source: (StackOverflow)

How to see log to find a boot problem

I want to find the cause of a boot problem I have tried ls -ltr /var/log from antony@antony which gives me login incorrect can someone tell me what command to use to see what has upset the boot thanks

NB when trying some commands from antony@antony then password I get login incorrect. Is that right?

Source: (StackOverflow)