topic Re: Syslog log rotation in Operating System - HP-UX

Syslog log rotation

Ronald W. Widlewski — Fri, 09 May 2008 11:35:41 GMT

I apologize if this question is basic and
redundant. Solaris has a command utility
"logadm" and corresponding "logadm.conf"
which effectively allows log rotation and
switching based on time, effectively
allowing log rotation for syslog and message
logs (very useful as a syslog server).

Is there an equivalent native function
within HPUX ?

Thanks in advance for your help and/or
suggestions.

Re: Syslog log rotation

TTr — Fri, 09 May 2008 12:06:46 GMT

logrotate is an open source product that was adopted in Solaris and Linux. It is not native to HP-UX but there is an old HP-UX build in

http://hpux.cs.utah.edu/hppd/hpux/Sysadmin/logrotate-2.5

Most system logs in HP-UX are rolled once at bootup. If you want additional rotations you have to come up with your own method. It is not difficult once you know the specifics of each log and how to handle open files.

You may want to check
http://forums11.itrc.hp.com/service/forums/questionanswer.do?threadId=799136

Bill has posted a script there.

Re: Syslog log rotation

Yogeeraj_1 — Fri, 09 May 2008 12:23:04 GMT

hi,

See also:
http://forums11.itrc.hp.com/service/forums/questionanswer.do?threadId=382206

You can schedule the logrotate to run at specific time of the day to perform the required maintenance - using cron.

good luck!
kind regards
yogeeraj

Re: Syslog log rotation

John Tartt — Fri, 09 May 2008 17:52:32 GMT

This is what I use on HPUX11i:

DATE=`date +%m%d%y`
ARCH=

# Roll over syslog.log
#
cd /var/adm/syslog
umask 022
cp syslog.log log.last
cp /dev/null syslog.log
/bin/kill -HUP `/bin/cat /var/run/syslog.pid`
uniq log.last $ARCH/syslog.${DATE}
rm log.last
#

NOTE: This way I can search all log files for a given month using one grep command. Since the month is the first two digits all I have to do is grep on syslog.04???? for all of Aprils syslog files.

Schedule this to run at 2359 and it will close out the day and start a new syslog.log file.

John

Re: Syslog log rotation

Ronald W. Widlewski — Wed, 14 May 2008 13:06:51 GMT

Thanks for your suggestions. I am attempting
to implement the logrotate utility but have
run into one issue that may be related to the config file (as shown):

/var/adm/syslog/syslog.log {
rotate 10
daily
create
ifempty
noolddir
copytruncate
postrotate
/sbin/killall -HUP syslogd
endscript
}

My problem (is) the syslog.log.1 file is
created and the syslog.log file continues
to exist, however the syslog.log file is
zero (0) length and the syslog.log.1 file
continues to be the active capturing log
file. Note I am using the 'daily' option
for testing and the copytruncate parameter
is (apparently) not supported in HPUX.
Thanks again...

Re: Syslog log rotation

Robert-Jan Goossens_1 — Wed, 14 May 2008 13:12:54 GMT

Try to change the kill command

/var/adm/syslog/syslog.log {
rotate 10
daily
create
ifempty
noolddir
copytruncate
postrotate
/bin/kill -HUP `/bin/cat /var/run/syslog.pid`
endscript
}

Re: Syslog log rotation

Heironimus — Wed, 14 May 2008 13:13:24 GMT

"/sbin/killall -HUP syslogd" is not correct on HP-UX (or on most other SysV-style platforms). Don't ever run killall directly. I think what you want is "kill -HUP `cat /var/run/syslog.pid`".

Re: Syslog log rotation

Ronald W. Widlewski — Mon, 19 May 2008 13:43:24 GMT

Thank you all, your assistance has been
extremely helpful. I am almost 'there'!
I have one remaining (hopefully small)
issue that I did not mention earlier. I
am also looking to trim the mail log.

My problem (is) the mail.log.1 file is
created, the mail.log file continues
to exist, however the mail.log file is
zero (0) length and the mail.log.1 file
continues to be the active capturing log
file. The .conf file file follows:

/var/adm/syslog/mail.log {
rotate 30
daily
create
ifempty
noolddir
#copytruncate
postrotate
/bin/kill -HUP `/usr/bin/head -1 /etc/mail/sendmail.pid`
endscript
}
The file listing follows:
-r--r--r-- 1 root root 0 May 19 00:01 mail.log
-r--r--r-- 1 root root 791 May 19 05:05 mail.log.1
-r--r--r-- 1 root root 1097 May 18 05:20 mail.log.2
-r--r--r-- 1 root root 791 May 17 05:05 mail.log.3
-r--r--r-- 1 root root 791 May 16 05:05 mail.log.4
-r--r--r-- 1 root root 1848 May 15 09:56 mail.log.5
-r--r--r-- 1 root root 7436032 May 14 05:05 mail.log.6

Thanks (again) in advance for your
help and suggestions.

Re: Syslog log rotation

Heironimus — Mon, 19 May 2008 14:33:48 GMT

I don't have an HP handy right now to check, but on most systems that I've seen sendmail does its logging through syslog. You probably need to send syslogd a HUP instead of sendmail. You can use fuser or lsof to check who's got the file open.

Re: Syslog log rotation

Court Campbell — Mon, 19 May 2008 15:00:18 GMT

I personally use:

http://freshmeat.net/projects/perl-logrotate/

works for me.

Re: Syslog log rotation

Ronald W. Widlewski — Mon, 02 Jun 2008 12:50:26 GMT

Thank you all for your assistance
and suggestions.

I was not 'quite' able to solve the
mail.log rotation issue, but the
syslog rotation operates perfectly.