System Administration
cancel
Showing results for 
Search instead for 
Did you mean: 

How to trim log file with out restarting syslogd

senthil_kumar_1
Super Advisor

How to trim log file with out restarting syslogd

Hi All,

I would like to trim one log file.

# /var/adm/syslog > ll
-rw-r--r-- 1 root sys 254125900 Jun 24 09:58 user_log


It's size is around 254MB, now I would like to trim to 1 or 2MB with out restarting syslogd.

Is it possible.
15 REPLIES
P Muralidhar Kini
Honored Contributor

Re: How to trim log file with out restarting syslogd

Hi Senthil,

Discussion on a similar requirement -
http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=1033864
http://forums13.itrc.hp.com/service/forums/questionanswer.do?threadId=1053445

Hope this helps.

Regards,
Murali
Let There Be Rock - AC/DC
AnthonySN
Respected Contributor

Re: How to trim log file with out restarting syslogd

you can do it thru sam.
you can trim upto a %
there are many more options in it.
AnthonySN
Respected Contributor

Re: How to trim log file with out restarting syslogd

im sorry this does not apply to user_log but other system logs.
Pete Randall
Outstanding Contributor

Re: How to trim log file with out restarting syslogd

Just using "> /var/adm/syslog/syslog.log" will null it out so I would think you could use tail on a copy of syslog to re-create the actual syslog with however much data you wish.

cp /var/adm/syslog/syslog.log /var/adm/syslog/syslog.copy
tail -2000 /var/adm/syslog/syslog.copy > /var/adm/syslog/syslog.log


Pete

Pete
James R. Ferguson
Acclaimed Contributor

Re: How to trim log file with out restarting syslogd

Hi Senthil:

The methodology shown by Pete will work. The key requirement to not restarting a logging daemon is *not* to change the inode number associated with the process's file handle for the file. Hence, you cannot simply 'mv' the log to another name and create a file of the original name in its place.

Regards!

...JRF...
singh sanjeev
Trusted Contributor

Re: How to trim log file with out restarting syslogd

i got this handy script of trimlog from net..hope this will help others also:



Triming a log file :save as trimlog with execute permission.

#! /bin/sh
# trimlog
filesize=`cat $1|wc -l`
trim=`expr $filesize - $2`
if [ $trim -gt 0 ]
then
sed "1,$trim d" $1 > /tmp/$1
mv /tmp/$1 $1
echo $1 trimmed by $trim lines
fi

sysntax : usage
#cat oracle_listener.log |wc -l
20000
for 50% reduction divide it by 2...
# trimlog oracle_listener.log 10000
Sanjeev Singh
Steven E. Protter
Exalted Contributor

Re: How to trim log file with out restarting syslogd

Shalom,

I like Pete's method also. sam might do a hangup restart on the syslod daemon. Not sure though.

JRF points out quite correctly that if you want the space back, trimming it with a script may be a problem. The space might not be released until the file handle is released.

I would try Pete's method and see what bdf and df -kh show after the fact.

SEP
Steven E Protter
Owner of ISN Corporation
http://isnamerica.com
http://hpuxconsulting.com
Sponsor: http://hpux.ws
Twitter: http://twitter.com/hpuxlinux
Founder http://newdatacloud.com
James R. Ferguson
Acclaimed Contributor

Re: How to trim log file with out restarting syslogd

Hi (again):

> SEP: JRF points out quite correctly that if you want the space back, trimming it with a script may be a problem. The space might not be released until the file handle is released.

There is no problem with the release of space. The method uses 'truncate()' to reduce the length of the file followed by a 'seek()' to align the file offset. Thus, the disk space used by the in-use file is reduced.

Regards!

...JRF...
Pete Randall
Outstanding Contributor

Re: How to trim log file with out restarting syslogd

The only problem I see in all this is that I mis-interpreted the title and never really studied the actual question. I assumed that we were talking about syslog.log (because of the syslogd mention), but I now see that Senthil is actually asking about something called user_log. I think my answer is still valid, it just needs to have "user_log" substituted for "syslog.log".

Sorry,


Pete

Pete
Raj D.
Honored Contributor

Re: How to trim log file with out restarting syslogd

F=user_log;k=200;t=`sed -n "$=" $F`;d=`expr $t - $k` ; perl -i -ne "print unless 1 .. $d" $F #Hth
" If u think u can , If u think u cannot , - You are always Right . "
Raj D.
Honored Contributor

Re: How to trim log file with out restarting syslogd

Senthil,


> I would like to trim to 1or 2MB ..



In the above example: (Details given ..)


F = Filename to trim = user_log
You may be want to keep last few lines of the log files , say last 200 lines you want to keep.

Keep = k = 200

Total_lines = t (Automatically calculated.)

Delete/Trim Lines = d = (Automatically calculated.)



- So here is the command you need to run to trim the file to just 200 line , or any minimum number you desire:



# cd /var/adm/syslog/
# F=user_log ; k=200 ; t=`sed -n "$=" $F`; d=`expr $t - $k` ; perl -i -ne "print unless 1 .. $d" $F

# wc -l user_log

200 user_log




- Now to see the size , you can use :
- # ls -l user_log #It should have trimmed to a small size in KB ).




Enjoy , Have fun!,
Raj.
" If u think u can , If u think u cannot , - You are always Right . "
Raj D.
Honored Contributor

Re: How to trim log file with out restarting syslogd

F=user_log;k=200;t=`sed -n "$=" $F`;d=`expr $t-$k`;perl -i -ne "print unless 1 .. $d" $F
" If u think u can , If u think u cannot , - You are always Right . "
James R. Ferguson
Acclaimed Contributor

Re: How to trim log file with out restarting syslogd

HI (again):

@ Raj:

Using 'perl -ni -e...' to perform an inplace file update will *NOT* work for trimming files where a (daemon) process is required to continue to update the trimmed file without a restart. Perl performs this slight-of-hand by renaming the original input file and thus changing its inode. Thus, the process continues to write to the *old* file, and any logging to the new file doesn't occur.

Regards!

...JRF...
Raj D.
Honored Contributor

Re: How to trim log file with out restarting syslogd


> Perl performs this slight-of-hand by renaming the original input file and thus changing its inode.

- This is really true.

Thanks for correcting. Yes, perl changes the inode of the file ,so log update doesn't happen further to that file, unless the daemon is restarted again. James, Thanks again for the valuable input.
" If u think u can , If u think u cannot , - You are always Right . "
Suraj K Sankari
Honored Contributor

Re: How to trim log file with out restarting syslogd

Hi Senthil,
What i use to do is copy this file with time stamp and trim this file to 0 bytes
like
#cp -p user_log user_log.24Jun2010
#>user_log

Suraj