topic Re: syslog in Operating System - HP-UX

syslog

siva baskaran — Sat, 20 May 2006 14:26:12 GMT

dears,

how to change syslog from syslog.log to oldsyslog.log file what one more thing what are the log files are to be monitored

thanks
siva

Re: syslog

Torsten. — Sat, 20 May 2006 15:22:49 GMT

Do you want to "rotate" the syslog.log file and reduce the size?

The most easy way is to use SAM -> routine tasks and "trim" the file. You also can copy the content to another file (if needed) and clear the content of the original file with any kind of unix tools, e.g. "cp syslog.log myoldsyslog.log" and "cat /dev/null >syslog.log"

Re: syslog

Torsten. — Sat, 20 May 2006 15:31:23 GMT

BTW, in the SAM-> routine tasks -> trim area you'll find a list of all relevant log files.
(e.g. syslog, software distributor, cron, reboot, ...)

Re: syslog

Darrel Louis — Sat, 20 May 2006 17:10:54 GMT

Hi Siva,

The logrotate utility is designed to simplify the administration of log files on a system which generates a lot of log files. Logrotate allows for the automatic rotation compression, removal and mailing of log files. Logrotate can be set to handle a log file daily, weekly, monthly or when the log file gets to a certain size. Normally, logrotate runs as a daily cron job.

http://packages.debian.org/cgi-bin/download.pl?arch=hppa&file=pool%2Fmain%2Fl%2Flogrotate%2Flogrotate_3.7.1-3_hppa.deb&md5sum=b4ff419979984d0d9778aff1733a5330&arch=hppa&type=main

Goodluck

Darrel

Re: syslog

Mridul Shrivastava — Sat, 20 May 2006 22:43:15 GMT

Log files to monitor (check if any error message is there):

Syslog /var/adm/syslog/syslog.log
Old Syslog /var/adm/syslog/OLDsyslog.log
Console messages dmesg (its a command)
Stm chasis code error log /var/stm/log/os/ccerrlog
Rc script log /etc/rc.log
Old rc script log /etc/rc.log.old
EMS events log /var/opt/resmon/log/event.log

Re: syslog

Ninad_1 — Sun, 21 May 2006 04:52:10 GMT

Hi,
The simplest way if you have enough space to copy the syslog file is
cd /var/adm/syslog
cp syslog.log oldsyslog.log
cat /dev/null > syslog.log

If you do not have enough space to have the original syslog file + copy of syslogfile(which you will name as oldsyslog), then stop the syslog daemon, mv the syslogfile
You can stop the syslog daemon as
/sbin/init.d/syslogd stop
ls -l syslog.log [ Note the permissions and ownership of the syslog.log file ]
mv /var/adm/syslog/syslog.log /var/adm/syslog/oldsyslog.log
touch syslog.log
Use chmod and chown to set the permission and ownership of the syslog file as original
/sbin/init.d/syslogd start

The various log file you should monitor are
/var/adm/messages
/etc/rc.log [ Usually only after a system startup ]
/var/adm/syslog/syslog.log
Also check your /etc/syslog.conf to see if its been configured to log to any other files than syslog.log
Also its worth writing a small script which will monitor thr filesystem usage and mail you whenever any critical filesystems/any filesystem is greater then say 90%
You should also check the mails to root using mailx

Regards,
Ninad

Re: syslog

Sivakumar TS — Sun, 21 May 2006 08:54:56 GMT

Hi Siva baskaran,

You can also copy the current syslog file to diff filename( oldsyslog.log) when the server is running and latter you can nullify the syslog.log file. ( by # > syslog.log )

Normally this happens during a reboot. ie, syslog will be coppiedn as OLDsyslog.

Regards,

Siva.

Re: syslog

Sivakumar TS — Sun, 21 May 2006 09:08:46 GMT

And the other important logs to monitor could be

run control script log -->
/etc/rc.log

EMS events log-- /var/opt/resmon/log/event.log

and

/etc/shutdownlog

also sulog --> for security reasons

Regards,

Siva.

Re: syslog

Michael D. Zorn — Mon, 22 May 2006 13:58:24 GMT

For me, at least, there are a lot of things I don't care about in syslog. I have a script that calls 'sed' to strip out irrelevant details.

The sequence that seems to work well is

#syslog.sed > syslog.sed
#cat /dev/null > syslog.log

If there aren't any unuseful things in the log, just copy syslog.log to a datesamp file and cat the null onto it.

Re: syslog

Rick Garland — Mon, 22 May 2006 14:12:48 GMT

The logrotate utility is a very handy tool for keeping your log files in check - otherwise they can grow without bounds.

The syslog.log file gets changed to OLDsyslog.log when the system is rebooted - manually or the result of a crash. Look into the /sbin/init.d/syslogd file.

/var/adm/wtmp
/var/adm/cron/log
/var/adm/snmpd.log
/var/adm/sulog
/var/adm/syslog/sudo.log
/var/adm/syslog/xferlog
/var/adm/syslog/mail.log
/var/adm/syslog/syslog.log
/var/adm/syslog/ssh.log

Here is an incomplete list. The logs you rotate will depend on your environment. Example, not everybody runs Secure Shell so there will not be a ssh.log file. Also look into the EMS logs, the rc.log, etc.