Edit log flie that is in use?

[Jim Turner]

Oh Great Ones,

Consider /var/adm/syslog/mail.log on a busy mail relay, please. It is being appended constantly by sendmail via syslogd. Now let's say this file is enormous and contains entries back through late April. Is there any way that you know of that would allow me to amputate all entries prior to June "on the fly" without either
1. Temporarily stopping syslogd (where best-case is mail log messages get lost and worst-case is sendmail pukes and dies), or
2. Temporarily stopping sendmail (which pisses off users because their joke-of-the-day email is ten minutes late)?

Thanks in advance,
Jim

[Patrick Wallek]

Have a look at the SAM -> Routine Tasks -> System Log Files and look for /var/adm/syslog/mail.log in the list. Select it and then go up to Actions and select Trim and then look at the options for trimming the log and select whatever is appropriate. This should trim the log without effecting sendmail.

[Jim Turner]

Patrick,

No soap:

The selected file "/var/adm/syslog/mail.log" is too big to view as it has "1096043546" bytes. Use another trim action to reduce the size to "32768" bytes or less, then try the trim to a line number action again.

This file busts 32k within a day of being zeroed-out.

Other ideas?
Jim

[Patrick Wallek]

A 1GB mail.log? Ouch!!!

Do you have room to make a copy of the file somewhere? Maybe to tape?

Then you could just do a '> mail.log' to zero it out again.

I think what I would then do is set up a nightly cron job to make a copy of the mail.log to mail.log.date and then compress it and then zero out the mail.log again. Then periodically if you don't need to keep them, delete the old logs.

[James R. Ferguson]

Hi Jim:

Try this:

1. First get the line number at which the region in the log you want to retain, starts:

# grep -n /var/adm/syslog/syslog.log

2. Using this line number (call it 'LINE') as the trim point, do:

# cd /var/adm/syslog
# sed -n $LINE,'$p' syslog.log > syslog.trimmed
# mv sylog.trimmed syslog.log

...JRF...

[James R. Ferguson]

Hi (again)

...oh, make that "mail.log" not "syslog.log"...

...JRF...

[John Bolene]

I have a machine running DCE logging and normally trim it around 500 Meg once a month using the trim function in SAM -> Routine Tasks -> System Log Files and look for /var/adm/syslog/syslog.log in the list.

It trims with no problem.

[Jordan Bean]

# cd /var/adm/syslog
# mv mail.log mail.log.old
# > mail.log
# kill -HUP $(cat /var/run/syslog.pid)
# mv mail.log mail.log.new
# grep '^Jun' mail.log.old > mail.log
# cat mail.log.new >> mail.log && kill -HUP $(cat /var/run/syslog.pid)

[Jim Turner]

Thank you all for the nice responses. I will try to answer/clarify:

Patrick, yeah, 1GB. Our InfoSec folks have an insane level of logging turned on in sendmail. The file size you saw was from April 27 until now.

James, I think I could script what you are suggesting and possibly get away with it. The switcheroo would have to be lightning fast, though. I'm a little unsure how unhappy syslogd would be over that. When I did the mv, would the inode change for the mail.log file that syslogd is writing to?

John, I already tried SAM in the manner you describe. See my 18:48 GMT reply to Patrick.

Jordan, I had to think about yours for a bit. Let me make sure I understand what you propose:
a. rename mail.log to mail.log.old (syslogd now writing sendmail logging to mail.log.old?)
b. create a new, zero-sized mail.log
c. SIGHUP syslogd (flip syslogd's writing of sendmail logging back to mail.log?)
d. rename mail.log to mail.log.new (syslogd now writing to mail.log.new?)
e. pull all of the june messages out of mail.log.old and put them in a new mail.log file.
f. append mail.log.new to the end of mail.log and SIGHUP syslogd (flip syslogd's writing of sendmail logging back to mail.log?)
Let me know (post here again) if I understand everything correctly. It sounds like it will do exactly what I need.

Folks, what makes this a bit complicated is that log messages are being written to the end of mail.log at a rate of one to five messages PER SECOND. That doesn't allow me any time to dawdle around diddling with files. However, what Jordan proposes looks like it can be done with everything hot because SIGHUP'ing syslogd can be made coincident with filename changes.

Thanks again everybody. Once I get a confirmation from Jordan, I'm going to try his procedure. I will post a final follow-up indicating success or failure.

Cheers,
Jim

[Jordan Bean · Accepted solution]

Correct, Jim.

You can rename the files while their open. SIGHUP tells Syslogd to flush and close all open file descriptors, re-read its configuration file, and open all log files by name.

For the last step, I'm assuming that cat will read the growing log file to true eof and SIGHUP will be issued without delay. Since syslog will be flushing its buffers before closing the file, a few entries may be missed in the transfer.