topic Re: Tracking log files in Operating System - HP-UX

Tracking log files

Vito Sarducci — Tue, 17 Jul 2001 13:39:46 GMT

Hello all,

How can i take all the system log files that my hp system creates daily and view them all thru one local file? The files that I want to view in one central file are the following;

/var/adm/sulog
/var/adm/messages
/var/adm/syslog/syslog.log (view last 500 lines)
/var/adm/syslog/mail.log (view last 500 lines)
/var/adm/cron/log (view last 24 hours)
/var/adm/log/backupfs.log (view last 500 lines)

Has anyone done this before? Is there an easy way to do this?

Please advise? thanks,

Chris
chrisam@rocketmail.com

Re: Tracking log files

Vito Sarducci — Tue, 17 Jul 2001 13:41:40 GMT

I forgot to ask, is there any HP utility or program that does this that i can download and install?

Any help is appreciated?

Chris
chrisam@rocketmail.com

Re: Tracking log files

Joseph C. Denman — Tue, 17 Jul 2001 13:46:31 GMT

You could write a script to do something like this????

###begin script
log=/var/adm/logs.tmp
cat /var/adm/sulog > $log
cat /var/adm/messages >> $log
tail -500 /var/adm/syslog/syslog.log >> $log
tail -500 /var/adm/syslog/mail.log >> $log
cat /var/adm/cron/log >> $log
tail -500 /var/adm/log/backupfs.log >> $log
more $log
rm $log
##end script

...jcd...

Re: Tracking log files

Patrick Wallek — Tue, 17 Jul 2001 13:51:03 GMT

There is no HP software / utility to do what you want to do. I would write a simple script that will take the parts of each logfile that you want to view and write it to another file. By the way, there is no /var/adm/messages on HP-UX, that is a solaris file. The equivalent is /var/adm/syslog/syslog.log on HP-UX.

An example:
mylogfile=mylogfile.`date +%m%d%Y`
echo "****************/var/adm/sulog****************" > $mylogfile
cat /var/adm/sulog >> $mylogfile
echo "" >> $mylogfile
echo "*******************/var/adm/syslog/syslog.log*********" >> $mylogfile
tail -500 /var/adm/syslog/syslog.log >> $mylogfile
echo "" >> $mylogfile
echo "*******************/var/adm/syslog/mail.log***********" >> $mylogfile
tail -500 /var/adm/syslog/mail.log >> $mylogfile
echo "" >> $mylogfile
echo "*******************/var/adm/cron/log*************" >> $mylogfile
tail -500 /var/adm/cron/log >> $mylogfile
echo "" >> $mylogfile
echo "**************/var/adm/log/backupfs.log**************" >> $mylogfile
tail -500 /var/adm/log/backupfs.log >> $mylogfile

Now you have everything in one file. If you want to e-mail the file to yourself add in the script:

mailx -s "Daily log file report" Your_email@whatever.com < $mylogfile

Hope this helps.

Re: Tracking log files

A. Clay Stephenson — Tue, 17 Jul 2001 13:52:26 GMT

Hi Chris:

Everything except the cron log is quite easy:

T1=/tmp/myfile
cat var/adm/sulog > $T1
cat /var/adm/messages >> $T1
tail -n 500 /var/adm/syslog/syslog.log >> $T1
tail -n 500 /var/adm/syslog/mail.log >> $T1
tail -n 500 /var/adm/cron/log >> $T1
tail -n /var/adm/log/backupfs.log >> $T1

you can then vi/pg/more /tmp/myfile.

This is not quite the perfect solution since it looks at the last 500 lines of the cron log rather than pattern matching for the first desired date and copying from that point on using awk, sed, perl, ... . I leave that as a student exercise.

Regards, Clay

Re: Tracking log files

MANOJ SRIVASTAVA — Tue, 17 Jul 2001 14:02:07 GMT

Hi Chris

I would go with Patricks solution since you also get the headers at the start of each file contents to differentiate between what is what , sincee it will be a lot of Data. My script is also similar to the one.

Manoj Srivastava

Re: Tracking log files

James R. Ferguson — Tue, 17 Jul 2001 14:16:05 GMT

Hi Chris:

My approach for concatenating the individual files together would be the same. HOWEVER, the 'tail' function has a limited buffer. You will find a 500-line specification is sometimes excessive and you will end up with quite a bit less. You could do the following:

#!/usr/bin/sh
L=`wc -l < /var/adm/syslog/syslog.log`
let L=$L-500
sed "1,${L}d" /var/adm/syslog/syslog.log > /tmp/syslog

In this case, /tmp/syslog will truly contain the last 500 lines of the original.

...JRF...

Re: Tracking log files

Ralf Hildebrandt — Tue, 17 Jul 2001 15:43:42 GMT

A bizarre approach to logfiles. Why not extract what you're really not interested in and display the res?
Try using xlogmaster.
http://www.gnu.org/software/xlogmaster/