cancel
Showing results for 
Search instead for 
Did you mean: 

Log management in HP-UX

 
SOLVED
Go to solution
Highlighted
senthil_kumar_1
Super Advisor

Log management in HP-UX

Hi All,

I am new to HP-UX.

I would like to know the log management in HP-UX.

I know followings about log management.

1)About Syslog:

There is two log files are available for syslog.

i)OLDsyslog.log
ii)syslog.log


Syslog.log is current file and OLDsyslog.log is old file.

Now I have some questions on syslog:

1.1)When (how many days once) the log are being transfered from syslog.log to OLDsyslog?


1.2)On of my HP-UX server (HP-UX 11.11) has no data with in OLDsyslog.log, example:

# ll OLDsyslog.log
-rw-r--r-- 1 root sys 0 Mar 4 00:01 OLDsyslog.log


But it has six syslog files, I think log rotation has been done, but I dont know how they (pervious unix admin) done this.

Example:

-rw-r--r-- 1 root sys 1119967 Mar 4 08:29 syslog.log
-rw-r--r-- 1 root sys 3222700 Mar 4 00:01 syslog.log.1
-rw-r--r-- 1 root sys 89506 Aug 7 2008 syslog.log.1.orig.gz
-rw-r--r-- 1 root sys 4168313 Mar 3 00:01 syslog.log.2
-rw-r--r-- 1 root sys 105763 Nov 22 10:30 syslog.log.2.gz
-rw-r--r-- 1 root sys 3989978 Mar 2 00:01 syslog.log.3
-rw-r--r-- 1 root sys 238659 Nov 22 00:01 syslog.log.3.gz
-rw-r--r-- 1 root sys 3092849 Mar 1 00:01 syslog.log.4
-rw-r--r-- 1 root sys 247459 Nov 21 00:01 syslog.log.4.gz
-rw-r--r-- 1 root sys 2993922 Feb 28 00:01 syslog.log.5
-rw-r--r-- 1 root sys 229038 Nov 20 00:01 syslog.log.5.gz
-rw-r--r-- 1 root sys 3373747 Feb 27 00:01 syslog.log.6
-rw-r--r-- 1 root sys 251639 Nov 19 00:01 syslog.log.6.gz


How to find that why the OLDsyslog.log has no entries, and instead how the six syslog.log files are available?


So I have two questions:

1.1)When (how many days once) the log are being transfered from syslog.log to OLDsyslog?

1.2)How to find that why the OLDsyslog.log has no entries, and instead how the six syslog.log files are available?
23 REPLIES 23
Torsten.
Acclaimed Contributor
Solution

Re: Log management in HP-UX

syslog will be moved to OLDsyslog after a reboot. Everything else is not standard, but customized by user scripts.

Hope this helps!
Regards
Torsten.

__________________________________________________
There are only 10 types of people in the world -
those who understand binary, and those who don't.

__________________________________________________
No support by private messages. Please ask the forum!

If you feel this was helpful please click the KUDOS! thumb below!   
Patrick Wallek
Honored Contributor

Re: Log management in HP-UX

1.2) It appears that someone may have set up something like 'logrotate' to do a daily log rotation.

Check your root cron jobs for something like 'logrotate'. If it is there then you can look at the logrotate script and configuration files to determine what it is doing.
Johnson Punniyalingam
Honored Contributor

Re: Log management in HP-UX

>>1.1)When (how many days once) the log are being transfered from syslog.log to OLDsyslog?<<

As per normal behaviour it doesn't goes by days, when ever syslogd demons has been restarted either by reboot or syslod deamon restarted it will automatically rename or move existing syslog.log to OLDsyslog.log and new "syslog.log" has been created.

>>1.2)How to find that why the OLDsyslog.log has no entries, and instead how the six syslog.log files are available?<<<

This realy depends on scripts which in the server which is creating "Six....etc. syslog"

HTH,

Johnson
Problems are common to all, but attitude makes the difference
Johnson Punniyalingam
Honored Contributor

Re: Log management in HP-UX

Duplicate Thread, Please close it*& Continue with Original one.

http://forums11.itrc.hp.com/service/forums/questionanswer.do?threadId=1412369
Problems are common to all, but attitude makes the difference
madhuchakkaravarthy
Trusted Contributor

Re: Log management in HP-UX

Hi senthil

when ever the syslogd daemon are restarted ,, due to reboot or shutdown u will have oldsyslog.log...

if u have any test servers try to see the difference by rebooting or stopping syslogd daemon,,, but both entries will be in syslog.


regards

MC
senthil_kumar_1
Super Advisor

Re: Log management in HP-UX

Hi All,

I have found following entries in /etc/syslog.conf file.

#############################################
mail.debug /var/adm/syslog/mail_log
*.info;mail.none /var/adm/syslog/syslog.log
*.alert /dev/console
*.alert root
*.emerg *
mail.alert /var/adm/syslog/mail_log
mark.debug /var/adm/syslog/mark_log
kern.info /var/adm/syslog/kern_log
user.info /var/adm/syslog/user_log
daemon.alert /var/adm/syslog/daemon_log
auth.info /var/adm/syslog/auth_log
lpr.info /var/adm/syslog/lpr_log
security.info /var/adm/syslog/security_log

#############################################


Could you please explain the purpose of each line in detail?
Patrick Wallek
Honored Contributor

Re: Log management in HP-UX

This has nothing to do with your original question.

However, 'man syslogd' should answer your questions.
senthil_kumar_1
Super Advisor

Re: Log management in HP-UX

Hi All,

I have learned some information about syslog.

The syslogd command reads and logs messages into a set of files described by the configuration file /etc/syslog.conf.

Normally only the log files available in /var/adm/syslog directory are configure in /etc/syslog.conf.

So if we stop the syslog daemon the log files available in /var/adm/syslog will not get updated. But all other logs (cron , sulog, automount log) will get updated, am i correct?

Johnson Punniyalingam
Honored Contributor

Re: Log management in HP-UX

>>>So if we stop the syslog daemon the log files available in /var/adm/syslog will not get updated. But all other logs (cron , sulog, automount log) will get updated, am i correct?<<

NO

syslog.log -> (for system related logs,but some normal entry will added for daemons like,crond,inetd,ftpd,automout...etc) but in details logging are printed for cron,su,automount, see below locattions).

cron log -> ( /var/adm/cron/log -> crontab

su log -> switch user logs (/var/adm/sulog)

automount log -> /var/adm/automount.log

so in-short all (cron,su,automount) have there own logging file,

so if restart "syslogd" you can see OLDSyslog.log & syslog.log will only updated not others.

HTH,

Regards,
Johnson
Problems are common to all, but attitude makes the difference