topic Re: How to trim the logfiles with active process writing to? in Operating System - HP-UX

How to trim the logfiles with active process writing to?

Aldis Black — Wed, 03 Nov 2010 08:37:59 GMT

Hi all, I am trying to zero the size of long running session logs from rootsh, but it seems to be impossible untill the process is active. I tried to run cat /dev/null > but the logsize remains unchanged. Any ideas on how to deal with this?

Thanks, Aldis

Re: How to trim the logfiles with active process writing to?

R.K. # — Wed, 03 Nov 2010 09:00:32 GMT

Hi..

How about using only the ">" symbol.
Eg.
# > /var/adm/syslog/syslog.log

Re: How to trim the logfiles with active process writing to?

Aldis Black — Wed, 03 Nov 2010 09:12:50 GMT

Nope. Still the same.

Re: How to trim the logfiles with active process writing to?

Prashantj — Wed, 03 Nov 2010 09:19:47 GMT

Hi Aldis,

#!/bin/sh
export today=`date -u +%b%d`
cd /var/adm/syslog
#
cat syslog.log |grep Logging |mailx -s "trim syslog" root
# Copy active file to old directory
cat syslog.log >./old.syslog/$today.syslog
cat mail.log >./old.maillog/$today.maillog
# Initialize active file
>syslog.log
>mail.log
# Delete file(s) older than 120 days from old directory
find /var/adm/syslog/old.syslog/ -mtime +120 -exec rm {} \;
find /var/adm/syslog/old.maillog/ -mtime +120 -exec rm {} \;

Hope this will help you.

Prashant

Re: How to trim the logfiles with active process writing to?

Aldis Black — Wed, 03 Nov 2010 09:24:50 GMT

Hi Prashant, Unfortunately it doesn't help as the commands used in the script (>logfile) seem to be not working on my logs as discussed above.

Re: How to trim the logfiles with active process writing to?

R.K. # — Wed, 03 Nov 2010 09:28:47 GMT

Hi Again,

Try copying /dev/null over the log file. Also see if you can find any option in sam.

Refer:
http://forums11.itrc.hp.com/service/forums/questionanswer.do?threadId=1033864

Re: How to trim the logfiles with active process writing to?

Prashantj — Wed, 03 Nov 2010 09:34:31 GMT

Hi Aldis,

Can u share the output of below commands

1)pwd ( where '>'not working )
2)echo $SHELL
3)ll /var/adm/syslog/syslog.log
4)id
5)check bdf output, if any filsystem reach 99%

Prashant

Re: How to trim the logfiles with active process writing to?

Aldis Black — Wed, 03 Nov 2010 09:45:16 GMT

Hi R.K. # ,

the cp /dev/null does not work here as well. Strange thing is that right after running any of the previously mentioned commands the filesize changes to zero bytes for a few seconds and then goes back to the previous value... any clue?

Re: How to trim the logfiles with active process writing to?

R.K. # — Wed, 03 Nov 2010 09:46:58 GMT

What is this log file actually related to?
Any application or OS?

Re: How to trim the logfiles with active process writing to?

Dennis Handly — Wed, 03 Nov 2010 09:47:37 GMT

>then goes back to the previous value... any clue?

If the writer is tracking where he thinks the file position is and writes to that position, you can't change that.

Re: How to trim the logfiles with active process writing to?

Aldis Black — Wed, 03 Nov 2010 10:08:56 GMT

This are the logfiles of rootsh (keystroke logging tool). Looks like it is tracking the file indeed - just tried to move the logfile and it keeps writing to it anyway!
Still i need to find a way to trim those files as the users keep the sessions open for several days and the logfiles grow fast. Please advise!

Re: How to trim the logfiles with active process writing to?

James R. Ferguson — Wed, 03 Nov 2010 11:19:04 GMT

Hi Aldis:

# > filename

or:

# cat /dev/null > filename

If no process is using the file, it will be reduced to a size of zero.

If a process is using the file, then this will return disk blocks to the system but will not change the length of the file that the process with the file open "sees". Rather the file will be sparse with nulls at its beginning. This is generally not an issue for log files.

Regards!

...JRF...

Re: How to trim the logfiles with active process writing to?

TTr — Wed, 03 Nov 2010 12:14:51 GMT

> just tried to move the logfile and it keeps writing to it anyway!

Does rootsh accept a HUP signal?

# mv logfile logfile-old
(the logfile-old is still open and written to)

# kill -HUP rootsh-PID
(The -HUP signal *might* make the rootsh start a new logfile under the original name)

Re: How to trim the logfiles with active process writing to?

Court Campbell — Wed, 03 Nov 2010 19:51:39 GMT

I have always been a fan of he truncate function in perl.