topic Re: Remove specific error messages from syslog.log in Operating System - HP-UX

Remove specific error messages from syslog.log

Ryan Bernard — Mon, 12 Jan 2009 03:58:25 GMT

Hi. I trying to find a way to reduce the size of syslog.log by removing certain error messages in the log.

Will it be possible to do this by writing a script which will search for the messages and then cut those messages from syslog.log?

Thanks in advance.

Re: Remove specific error messages from syslog.log

Bill Hassell — Mon, 12 Jan 2009 04:41:10 GMT

Cutting out specific lines will require a program. Scripting can use tools like awk, sed and grep ot filter important messages. However, it is too complex to strip lines from an active file like syslog.log. Instead, you can filter syslog into a smaller file and refer to that file for the interesting messages. AS for syslog's size, every Unix system must have a syslog managament tool. It will grow without bounds so it must be checked weekly and when it gets to be dozens of MB in size, copy it, zero the syslog file,
then compress the copy.

Here is a quick method to filter intersting messages:

grep -ie fail -e crit -e error -e disable -e lock /var/adm/syslog/syslog.log

Another method to analyze syslog is to look for repeating messages. This will count the number of times the same message is recorded in syslog:

MYHOST=$(hostname)
cat /var/adm/syslog/syslog.log \
| sed -e "s/^.*$MYHOST//" -e 's/\[[0-9]*\]//' \
| grep -v "above message repeats" \
| sort \
| uniq -c \
| sort -rn

The above script will point out messages that occur over and over.

Re: Remove specific error messages from syslog.log

James R. Ferguson — Mon, 12 Jan 2009 10:31:15 GMT

Hi Ryan:

Another way you might want to reduce the size of your 'syslog.log' is to _not_ record too much information in the first place. Perhaps that is one issue you have. For instance, you may be retaining part of the previous log with 'PREV_OLDSYSLOG_LINES' or you may have debugging log levels set when you no longer need them.

You can also configure your logging to keep a message class in a separate file other than 'syslog'.

Have a look at the 'syslogd(1M)' manpages for specific details and examples.

http://www.docs.hp.com/en/B2355-60130/syslogd.1M.html

Regards!

...JRF...

Re: Remove specific error messages from syslog.log

Ryan Bernard — Wed, 14 Jan 2009 14:43:11 GMT

Thanks to all for your advice.

Currently there is a error msg that keep appearing in syslog.log. This error msg is harmless and can be disregard.

If removing this error message from syslog.log is too complex, is there anyway we can filter the error coming in, such as telling the server that it can disregard this particular error msg?

Re: Remove specific error messages from syslog.log

James R. Ferguson — Wed, 14 Jan 2009 14:51:23 GMT

Hi Ryan:

If the message is "harmless" but "annoying" you can modify your '/etc/rc.config.d/syslogd' to enable the facility and priority logging with the message. Then, you may be able to explictly reconfigure '/etc/syslog.conf' to ignore the message.

Regards!

...JRF...

Re: Remove specific error messages from syslog.log

Avinash20 — Wed, 14 Jan 2009 14:57:17 GMT

What is the error message you are getting ?