SAP Note 11886 - Central SysLog cut off.

Symptom

The central SysLog is cut off.
Transaction sm21, program RSLG0012
Collector daemon "rslgcoll" (or "co.sap..." will not start
and reports "read half record".

Cause and prerequisites

Disk in operation was full. (/usr/sap/C11/SYS/global/)

Up to Release 2.1, the SysLog collector daemon uses "stdio" for
writing. Unfortunately, it was later established that standard I/O,
which was always preferred for its ease of portability, does not
support recovery after errors like "Disk full". The standard I/O
packet loses 8 KB of data after every failed write attempt.

Because the central SysLog has a fixed record length of
(currently) 152 bytes, such files can no longer be read properly.

Solution
If the disk was only full once, and was still full when R/3 was
shut down, then case (A) applies. If the disk was only temporarily
full, case (B) applies. Special case (C) only applies if the disk
filled up several times during a run, and the central SysLog file
had a length that was a multiple of 152 kbytes after the last run.

(A) The SysLog file is ok, only the last record is incomplete.
+ Evaluation works properly
+ Collector daemon refuses to work after system startup.

Use program RSLG0019 to repair the file

(or, at UNIX level, use echo x >> ... ; ls -l ...
to add bytes to the file until its length is a multiple of 152).

(B) A part is missing from the SysLog file. Everything after that
is shifted.
+ Evaluation shows garbage.
+ Collector daemon refuses to work after system startup.

It is VERY difficult to repair the file. It is better to
delete it.

(C) The SysLog file is missing several parts, middle areas are
shifted, but is back in phase at the end.
+ Evaluation shows garbage.
+ Collector daemon works after system startup.

Repairing the file is VERY complicated. Either delete it
or wait until the defective portion has been overwritten (the
SysLog writes in a loop).

In Release 2.2, the SysLog collector daemon has been converted
to UNIX kernel I/O. If the disk is full, the system repeatedly
attempts to write again, after short pauses. If the disk can write
again before a system stop, no data is lost. Only case (A) can occur,
and only when the system is shut down with a full disk.

Key word: SysLog