Morning all

In a nutshell I have a PC-like system that is running a 10.? Slackware distribution and everytime I reboot it I lose the log files in /var/log ( messages, syslog, secure, snmpd etc ) as well as the *.1 etc versions. This obviously makes it difficult to debug a problem I am having with the system dying on me.

For my sins I normally work in the AIX world so I have some idea about what to try and where to look. I tried restarting syslogd to see if it was deleting the files and it didn't. I can't see how logrotate can have any influence here as it only runs once a day via a daily cron. I've done some searches and can't see any startup or shutdown scripts medeling with the contents of /var/log. Lastly I copied some logs to create fred and fred.1 and fred.2 and they were also deleted who I rebooted so whatever is doing it doesn't seem to be too selective.

I've had a good look around the forums and google and can't see anything on this.

Other details: We are running a 2.4.21 kernel with some extras for an inhouse special keyboard and Xserver.

Thanks in advance to anyone willing to spend the time to have a think about this.

Hedgealot

Check for cron entries, either in the crontab file, or in any of the cron folders. Usually the files are moved to a .1 or something on reboot so that the /var/log/messages or what ever only contians the current session.

The obviou hack is to back up the log files yourself before you reboot, but I would double check your cront entries and your syslog config files. All of wich can be found in the /etc folder