CMON deleted /var/log/mysql.log but didn't recreate it.

Hi!

Which script is responsible for collecting logs? I couldn't find it.

It has deleted logs today and couldn't create them again. Why?

Logs from cmon

----------------------------------------------------------------------------------------------------------------------

Feb 11 08:30:00 : (INFO) Sucessfully pulled log /var/log/mysql.log from 10.1.160.6.

Feb 11 08:30:01 : (INFO) Sucessfully pulled log /var/log/mysql.log from 10.1.160.7.

Feb 11 08:30:01 : (INFO) Sucessfully pulled log /var/log/mysql.log from 10.1.160.8.

Feb 11 09:06:57 : (ERROR) stat of /var/log/mysql.log failed (on host 10.1.160.8)

Feb 11 09:30:01 : (INFO) Sucessfully pulled log /var/log/mysql.log from 10.1.160.6.

Feb 11 09:30:01 : (INFO) Sucessfully pulled log /var/log/mysql.log from 10.1.160.7.

Feb 11 09:30:02 : (INFO) Failed to pull log /var/log/mysql.log from 10.1.160.8.

Feb 11 10:11:58 : (ERROR) stat of /var/log/mysql.log failed (on host 10.1.160.7)

Feb 11 10:11:58 : (ERROR) stat of /var/log/mysql.log failed (on host 10.1.160.8)

Feb 11 10:30:00 : (INFO) Sucessfully pulled log /var/log/mysql.log from 10.1.160.6.

Feb 11 10:30:01 : (INFO) Failed to pull log /var/log/mysql.log from 10.1.160.7.

Feb 11 10:30:01 : (INFO) Failed to pull log /var/log/mysql.log from 10.1.160.8.

Feb 11 12:02:02 : (ERROR) stat of /var/log/mysql.log failed (on host 10.1.160.7)

Feb 11 12:02:02 : (ERROR) stat of /var/log/mysql.log failed (on host 10.1.160.8)

Feb 11 12:30:01 : (INFO) Sucessfully pulled log /var/log/mysql.log from 10.1.160.6.

Feb 11 12:30:01 : (INFO) 10.1.160.7 - no reply :/usr/bin/tail -n2000 '/var/log/mysql.log'

Feb 11 12:30:01 : (INFO) Failed to pull log /var/log/mysql.log from 10.1.160.7.

Feb 11 12:30:02 : (INFO) Sucessfully pulled log /var/log/mysql.log from 10.1.160.8.

System log

---------------------------------------------------------------------------------------------------------------------------

root@primysql08prod1-galera3:/var/log# egrep -ri 'FEB 11 [0-9]+:[0-9]+:[0-9]+' ./* | egrep 'rm '

./auth.log:Feb 11 02:16:09 primysql08prod1-galera3 sudo:   galera : TTY=pts/1 ; PWD=/home/galera ; USER=root ; COMMAND=/bin/rm -rf /tmp/s9s_backupc_1.log

./auth.log:Feb 11 02:17:22 primysql08prod1-galera3 sudo:   galera : TTY=pts/1 ; PWD=/home/galera ; USER=root ; COMMAND=/bin/rm -rf /tmp/xtrabackup_pid

./auth.log:Feb 11 04:16:09 primysql08prod1-galera3 sudo:   galera : TTY=pts/1 ; PWD=/home/galera ; USER=root ; COMMAND=/bin/rm -rf /tmp/s9s_backupc_1.log

./auth.log:Feb 11 04:17:16 primysql08prod1-galera3 sudo:   galera : TTY=pts/1 ; PWD=/home/galera ; USER=root ; COMMAND=/bin/rm -rf /tmp/xtrabackup_pid

./auth.log:Feb 11 06:16:09 primysql08prod1-galera3 sudo:   galera : TTY=pts/1 ; PWD=/home/galera ; USER=root ; COMMAND=/bin/rm -rf /tmp/s9s_backupc_1.log

./auth.log:Feb 11 06:17:16 primysql08prod1-galera3 sudo:   galera : TTY=pts/1 ; PWD=/home/galera ; USER=root ; COMMAND=/bin/rm -rf /tmp/xtrabackup_pid

./auth.log:Feb 11 08:16:09 primysql08prod1-galera3 sudo:   galera : TTY=pts/1 ; PWD=/home/galera ; USER=root ; COMMAND=/bin/rm -rf /tmp/s9s_backupc_1.log

./auth.log:Feb 11 08:17:16 primysql08prod1-galera3 sudo:   galera : TTY=pts/1 ; PWD=/home/galera ; USER=root ; COMMAND=/bin/rm -rf /tmp/xtrabackup_pid

./auth.log:Feb 11 09:01:57 primysql08prod1-galera3 sudo:   galera : TTY=pts/1 ; PWD=/home/galera ; USER=root ; COMMAND=/bin/sh -c rm -f /var/log/mysql.log

./auth.log:Feb 11 10:16:08 primysql08prod1-galera3 sudo:   galera : TTY=pts/1 ; PWD=/home/galera ; USER=root ; COMMAND=/bin/rm -rf /tmp/s9s_backupc_1.log

./auth.log:Feb 11 10:17:21 primysql08prod1-galera3 sudo:   galera : TTY=pts/1 ; PWD=/home/galera ; USER=root ; COMMAND=/bin/rm -rf /tmp/xtrabackup_pid

./auth.log:Feb 11 12:02:35 primysql08prod1-galera3 sudo:   galera : TTY=pts/1 ; PWD=/home/galera ; USER=root ; COMMAND=/bin/rm -rf /tmp/s9s_backupc_1.log

./auth.log:Feb 11 12:03:42 primysql08prod1-galera3 sudo:   galera : TTY=pts/1 ; PWD=/home/galera ; USER=root ; COMMAND=/bin/rm -rf /tmp/xtrabackup_pid

./auth.log:Feb 11 14:16:09 primysql08prod1-galera3 sudo:   galera : TTY=pts/1 ; PWD=/home/galera ; USER=root ; COMMAND=/bin/rm -rf /tmp/s9s_backupc_1.log

./auth.log:Feb 11 14:17:16 primysql08prod1-galera3 sudo:   galera : TTY=pts/1 ; PWD=/home/galera ; USER=root ; COMMAND=/bin/rm -rf /tmp/xtrabackup_pid