System Administration
cancel
Showing results for 
Search instead for 
Did you mean: 

How to trim log file with out restarting syslogd

 
senthil_kumar_1
Super Advisor

How to trim log file with out restarting syslogd

Hi All,

I would like to trim one log file.

# /var/adm/syslog > ll
-rw-r--r-- 1 root sys 254125900 Jun 24 09:58 user_log


It's size is around 254MB, now I would like to trim to 1 or 2MB with out restarting syslogd.

Is it possible.
15 REPLIES 15
P Muralidhar Kini
Honored Contributor

Re: How to trim log file with out restarting syslogd

Hi Senthil,

Discussion on a similar requirement -
http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=1033864
http://forums13.itrc.hp.com/service/forums/questionanswer.do?threadId=1053445

Hope this helps.

Regards,
Murali
Let There Be Rock - AC/DC
AnthonySN
Respected Contributor

Re: How to trim log file with out restarting syslogd

you can do it thru sam.
you can trim upto a %
there are many more options in it.
AnthonySN
Respected Contributor

Re: How to trim log file with out restarting syslogd

im sorry this does not apply to user_log but other system logs.
Pete Randall
Outstanding Contributor

Re: How to trim log file with out restarting syslogd

Just using "> /var/adm/syslog/syslog.log" will null it out so I would think you could use tail on a copy of syslog to re-create the actual syslog with however much data you wish.

cp /var/adm/syslog/syslog.log /var/adm/syslog/syslog.copy
tail -2000 /var/adm/syslog/syslog.copy > /var/adm/syslog/syslog.log


Pete

Pete
James R. Ferguson
Acclaimed Contributor

Re: How to trim log file with out restarting syslogd

Hi Senthil:

The methodology shown by Pete will work. The key requirement to not restarting a logging daemon is *not* to change the inode number associated with the process's file handle for the file. Hence, you cannot simply 'mv' the log to another name and create a file of the original name in its place.

Regards!

...JRF...
singh sanjeev
Trusted Contributor

Re: How to trim log file with out restarting syslogd

i got this handy script of trimlog from net..hope this will help others also:



Triming a log file :save as trimlog with execute permission.

#! /bin/sh
# trimlog
filesize=`cat $1|wc -l`
trim=`expr $filesize - $2`
if [ $trim -gt 0 ]
then
sed "1,$trim d" $1 > /tmp/$1
mv /tmp/$1 $1
echo $1 trimmed by $trim lines
fi

sysntax : usage
#cat oracle_listener.log |wc -l
20000
for 50% reduction divide it by 2...
# trimlog oracle_listener.log 10000
Sanjeev Singh
Steven E. Protter
Exalted Contributor

Re: How to trim log file with out restarting syslogd

Shalom,

I like Pete's method also. sam might do a hangup restart on the syslod daemon. Not sure though.

JRF points out quite correctly that if you want the space back, trimming it with a script may be a problem. The space might not be released until the file handle is released.

I would try Pete's method and see what bdf and df -kh show after the fact.

SEP
Steven E Protter
Owner of ISN Corporation
http://isnamerica.com
http://hpuxconsulting.com
Sponsor: http://hpux.ws
Twitter: http://twitter.com/hpuxlinux
Founder http://newdatacloud.com
James R. Ferguson
Acclaimed Contributor

Re: How to trim log file with out restarting syslogd

Hi (again):

> SEP: JRF points out quite correctly that if you want the space back, trimming it with a script may be a problem. The space might not be released until the file handle is released.

There is no problem with the release of space. The method uses 'truncate()' to reduce the length of the file followed by a 'seek()' to align the file offset. Thus, the disk space used by the in-use file is reduced.

Regards!

...JRF...
Highlighted
Pete Randall
Outstanding Contributor

Re: How to trim log file with out restarting syslogd

The only problem I see in all this is that I mis-interpreted the title and never really studied the actual question. I assumed that we were talking about syslog.log (because of the syslogd mention), but I now see that Senthil is actually asking about something called user_log. I think my answer is still valid, it just needs to have "user_log" substituted for "syslog.log".

Sorry,


Pete

Pete