topic syslog.log in Operating System - HP-UX

syslog.log

Feljav — Mon, 13 Nov 2006 13:14:06 GMT

The file syslog.log grow without restrictions?
Can be controlled its growth, that is not manually?

Re: syslog.log

Pete Randall — Mon, 13 Nov 2006 13:17:27 GMT

Whenever you reboot, a copy of syslog is made to /var/adm/syslog/OLDsyslog.log and /var/adm/syslog/syslog.log starts out fresh. You could also do this same thing with a cron job, once a week, or once a month or so.

Pete

Re: syslog.log

Victor BERRIDGE — Mon, 13 Nov 2006 13:19:11 GMT

Hi,

Yes, by the use of a tool such as rotatelog...
http://www.interhack.net/projects/rotatelog/

All the best
Victor

Re: syslog.log

Sp4admin — Mon, 13 Nov 2006 13:22:12 GMT

Hi Feljay,

I think Pete has it covered. On reboot the syslog whiches to OLDsyslog.log. Like Pete said you could create a cron job to cat /dev/null the log. How often do you reboot your server? I would'nt want to ran a cron job on syslog. But if you feel the need then it's possiable.

sp,

Re: syslog.log

Mark Nieuwboer — Mon, 13 Nov 2006 14:58:28 GMT

Hi Feljav,

Sorry to say but to reboot to clear syslog is not the idea of unix it is not windows.
just trim the log file. see http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=991878

our stop and start the syslog daemon you have the same result as a reboot.

grtz. Mark

Re: syslog.log

spex — Mon, 13 Nov 2006 15:43:15 GMT

Hi,

# crontab -l | grep archive_logs
59 23 * * * /home/root/archive_logs-daily.sh

# cat archive_logs-daily.sh
#!/usr/bin/sh
DATE=$(date +%Y%m%d)
###############################
# syslog
###############################
cd /var/adm/syslog
[ -f syslog.yester.log ] && rm -f syslog.yester.log
mv syslog.log syslog.${DATE}.log
ln -s syslog.${DATE}.log syslog.yester.log
find /var/adm/syslog -name '*.log' -mtime +90 -print | xargs rm -f
# Archive/rotate other logs here...
exit

PCS

Re: syslog.log

Jeff Wilkins — Mon, 13 Nov 2006 15:47:50 GMT

#!/sbin/sh
#
# This script file will dynamically assign a new filename, using the current
# datestamp, to the logfile definitions specified in the syslog configuration
# file.
#
###############################################################################
#

CFG_CURR=/etc/syslog.conf
CFG_LAST=/etc/syslog.conf.last
CFG_MSTR=/etc/syslog.conf.master

if [ -e ${CFG_LAST} ]; then /usr/bin/rm -f ${CFG_LAST} > /dev/null 2>&1 ; fi

/usr/bin/mv -f ${CFG_CURR} ${CFG_LAST}

/usr/bin/sed -e "s/\$DATE/`/usr/bin/date +%Y%m%d`/" ${CFG_MSTR} > ${CFG_CURR}

if [ -e ${CFG_CURR} ]; then /usr/bin/kill -s SIGHUP `/usr/bin/cat /var/run/syslog.pid`; fi

/usr/bin/compress -f `/usr/bin/grep "/var/adm/syslog/" ${CFG_LAST} | /usr/bin/sed -e "s/^.*\/var/\/var/"`

/usr/bin/find /var/adm/syslog/ -name *.Z -a ! -mtime -7 -exec /usr/bin/rm {} \;

#
#
###############################################################################

pg /etc/syslog.conf
# @(#) $Revision: 74.1 $
#
# syslogd configuration file.
#
# See syslogd(1M) for information about the format of this file.
#
*.info /var/adm/syslog/syslog_20061113.log
*.alert /dev/console
*.alert root
*.emerg *

/etc/syslog.conf.last same except
*.info /var/adm/syslog/syslog_20061112.log

/etc/syslog.conf.master same except
*.info /var/adm/syslog/syslog_$DATE.log

then run a cron to start the script at midnight

Re: syslog.log

Jeff Wilkins — Mon, 13 Nov 2006 15:51:15 GMT

for a little more explaination -
new log with date every day
compress yesterdays log
remove logs after 7 days
if you don't want them removed - uncompress them

Re: syslog.log

Rory R Hammond — Tue, 14 Nov 2006 01:08:06 GMT

rebooting to switch syslog is a bad Idea. I have systems that have been up for over a year.
The trick is to manage the logs.

I use a program called savelog which is similar to logrotate.

Caution about syslog.log. It is always open by syslogd. deleting syslog.log will not free up space. Basically I copy syslog.log to a backup name and zero out syslog.log with
echo > syslog.log
On my systems I zero out syslog.log weekly and keep 7 copies (7 weeks).

Re: syslog.log

dirk dierickx — Tue, 14 Nov 2006 01:57:27 GMT

i suggest logrotate, it works great and does some extra things as well which you might find
handy.

hpux depot can be found here:
http://hpux.connect.org.uk/hppd/hpux/Sysadmin/logrotate-2.5/