Description of problem: The syslogd is down and can't be restarted: [root@npfbs00 log]# /etc/init.d/syslog start Starting system logger: execvp: Permission denied [FAILED] Starting kernel logger: Version-Release number of selected component (if applicable): [root@npfbs00 log]# syslogd -v syslogd 1.4.1 How reproducible: Currently program is broken. Steps to Reproduce: 1. 2. 3. Actual results: Expected results: Additional info:
Hi Geoff, what version of sysklogd are you using? Running "rpm -q sysklogd" would tell. Does /var/log/audit/audit.log say anything about syslog? Could you please run "strace -f -s 4096 -o /tmp/syslog.strace /etc/init.d/syslog start" and attach the output file?
Thank you. Here is the information you requested. [root@npws01 chkrootkit]# rpm -q sysklogd sysklogd-1.4.1-44.el5 There is nothing in the audit logs concerning syslog.
Created attachment 314749 [details] Output from the strace command. The attached file is the output from the requeste command: strace -f -s 4096 -o /tmp/syslog.strace /etc/init.d/syslog start Thank you.
My apologies, my comments #2 and #3 should be discarded, I ran the command on the wrong host... Here is the correct information: [root@npfbs00 log]# rpm -q sysklogd sysklogd-1.4.1-27.el4 There are no files in the audit directory.
Created attachment 314752 [details] Output from strace command on correct host
Geoff, what does this command show? #ls -Z /etc/init.d/syslog /sbin/rsyslog
Thanks, here is the info... [root@npfbs00 tmp]# ls -Z /etc/init.d/syslog /sbin/rsyslog ls: /sbin/rsyslog: No such file or directory -rwxr-xr-x root root system_u:object_r:initrc_exec_t /etc/init.d/syslog
Ooops my fault. again please: #ls -Z /sbin/syslogd
Could you switch selinux into permissive mode for a while and start syslogd. Just to be sure it's not selinux related.
Thanks. The revised command: [root@npfbs00 tmp]# ls -Z /sbin/syslogd -rwxr-xr-x root root system_u:object_r:syslogd_exec_t /sbin/syslogd Put selinux in permissive mode... [root@npfbs00 tmp]# /etc/init.d/syslog start Starting system logger: [ OK ] Starting kernel logger: Thanks.
hmm, it seems you have problem with selinux here. Check you /var/log/messages. Relabeling your filesystem might be useful. touch /.autorelabel reboot