You shoudl start elogd interactively in a DOS box to see if there is any error. Maybe disk full or a network problem... 

 It is running on a linux box, we have started in it in a telnet session, and no errors appear, as I am new to e-log is there an error log anywhere.

 Have fixed this by removing the last added user from the Passwd file.

 Have fixed this by removing the last added user from the Passwd file.

I don't know if you can get elog to generate a log file - check the documentation, I don't bother.  But I do have some experience with this matter.

There are two related circumstances I know of that can arise which will cause elog to crash.

As you are probably aware, the entries are threaded.  I find the main problem is if you move a long thread - I forget the number but over 30 entries - from one log book to another, it will copy across fine, but the deletion of the thread from the source logbook will crash elog *before* the entire thread has been deleted: cause 1.

If you then restart elog, and happen to access the partially deleted thread, elog will run into a loop.  You won't be able to access elog, and you will see it is burning up CPU time, and it probably will eventually crash, but normally I find what the process number is and kill it (with "kill -9 [process no]").  This is cause 2.  The reason is that elog is looking for an entry number in the thread that no longer exists (because elog has already deleted it).

There is a moderately convoluted way I have devised to completely delete the partially deleted thread, needing access to the yymmdda.log files.  Cause 2 can also occur if someone manually edits yymmdda.log files with insufficient care (that includes me on occasion).  

I have a crontab set-up for root:

crontab -e

* * * * *       if ! ps -C elogd >/dev/null;then /sbin/service elogd restart;fi

The script just checks if elogd is still running and if not, it'll restart it. We run Centos, but I'm sure it'll be easy to adapt for Ubuntu (I don't know much about Debian).

This will only help if elogd really crashed; in case it is still running at 100% cpu load this won't help.

In our case (~30 logbooks, > 100 entries per day, ~ hundred users) elogd is crashing about once a week. With the help of this script it means 1 minute downtime a week: that's acceptable.

See https://midas.psi.ch/elog/config.html on how to use a logfile with elogd. Here's the relevant excerpt:

• Logfile = <file>
  This option specifies a filename which logs all login/logout activities and successful user connections for logbooks with user level access. The the logging level (see below) is larger than 1, also read and write accesses can be logged.
• Logging level = 1 | 2 | 3
  Specifies the logging level. The higher this value, the more information is logged. Default is 2:
  • 1: Log only logins and logouts
  • 2: Log also write accesses
  • 3: Log also read accesses

By desing, there is no collision between different users, since all requests are executed in sequence (single thread). The only problem is that the server becomes unavailable for others if it executes a long search. This is why most users of large lobooks restrict their search to let's say the last month or so by default. This speeds up the search and limits the dead time for others. This can be done via the show last default = <days> directive.

We have reduced entries for Search reasons by removing older text files and that seems to speed up things. 
However, a recurring problem persists during peak period where the service connection is lost (site says "Not 
found" on both client and directly on server), and it cannot be restarted or killed. Only a reboot of the 2010 
x64 virtual server will make it available again. 

Any further info or details I can provide please advise. Thank you Stefan.