Log management in HP-UX

[senthil_kumar_1]

Hi All,

I am new to HP-UX.

I would like to know the log management in HP-UX.

I know followings about log management.

1)About Syslog:

There is two log files are available for syslog.

i)OLDsyslog.log
ii)syslog.log


Syslog.log is current file and OLDsyslog.log is old file.

Now I have some questions on syslog:

1.1)When (how many days once) the log are being transfered from syslog.log to OLDsyslog?


1.2)On of my HP-UX server (HP-UX 11.11) has no data with in OLDsyslog.log, example:

# ll OLDsyslog.log
-rw-r--r-- 1 root sys 0 Mar 4 00:01 OLDsyslog.log


But it has six syslog files, I think log rotation has been done, but I dont know how they (pervious unix admin) done this.

Example:

-rw-r--r-- 1 root sys 1119967 Mar 4 08:29 syslog.log
-rw-r--r-- 1 root sys 3222700 Mar 4 00:01 syslog.log.1
-rw-r--r-- 1 root sys 89506 Aug 7 2008 syslog.log.1.orig.gz
-rw-r--r-- 1 root sys 4168313 Mar 3 00:01 syslog.log.2
-rw-r--r-- 1 root sys 105763 Nov 22 10:30 syslog.log.2.gz
-rw-r--r-- 1 root sys 3989978 Mar 2 00:01 syslog.log.3
-rw-r--r-- 1 root sys 238659 Nov 22 00:01 syslog.log.3.gz
-rw-r--r-- 1 root sys 3092849 Mar 1 00:01 syslog.log.4
-rw-r--r-- 1 root sys 247459 Nov 21 00:01 syslog.log.4.gz
-rw-r--r-- 1 root sys 2993922 Feb 28 00:01 syslog.log.5
-rw-r--r-- 1 root sys 229038 Nov 20 00:01 syslog.log.5.gz
-rw-r--r-- 1 root sys 3373747 Feb 27 00:01 syslog.log.6
-rw-r--r-- 1 root sys 251639 Nov 19 00:01 syslog.log.6.gz


How to find that why the OLDsyslog.log has no entries, and instead how the six syslog.log files are available?


So I have two questions:

1.1)When (how many days once) the log are being transfered from syslog.log to OLDsyslog?

1.2)How to find that why the OLDsyslog.log has no entries, and instead how the six syslog.log files are available?

[Torsten. · Accepted solution]

syslog will be moved to OLDsyslog after a reboot. Everything else is not standard, but customized by user scripts.

[Patrick Wallek]

1.2) It appears that someone may have set up something like 'logrotate' to do a daily log rotation.

Check your root cron jobs for something like 'logrotate'. If it is there then you can look at the logrotate script and configuration files to determine what it is doing.

[Johnson Punniyalingam]

>>1.1)When (how many days once) the log are being transfered from syslog.log to OLDsyslog?<<

As per normal behaviour it doesn't goes by days, when ever syslogd demons has been restarted either by reboot or syslod deamon restarted it will automatically rename or move existing syslog.log to OLDsyslog.log and new "syslog.log" has been created.

>>1.2)How to find that why the OLDsyslog.log has no entries, and instead how the six syslog.log files are available?<<<

This realy depends on scripts which in the server which is creating "Six....etc. syslog"

HTH,

Johnson

[Johnson Punniyalingam]

Duplicate Thread, Please close it*& Continue with Original one.

http://forums11.itrc.hp.com/service/forums/questionanswer.do?threadId=1412369

[madhuchakkaravarthy]

Hi senthil

when ever the syslogd daemon are restarted ,, due to reboot or shutdown u will have oldsyslog.log...

if u have any test servers try to see the difference by rebooting or stopping syslogd daemon,,, but both entries will be in syslog.


regards

MC

[senthil_kumar_1]

Hi All,

I have found following entries in /etc/syslog.conf file.

#############################################
mail.debug /var/adm/syslog/mail_log
*.info;mail.none /var/adm/syslog/syslog.log
*.alert /dev/console
*.alert root
*.emerg *
mail.alert /var/adm/syslog/mail_log
mark.debug /var/adm/syslog/mark_log
kern.info /var/adm/syslog/kern_log
user.info /var/adm/syslog/user_log
daemon.alert /var/adm/syslog/daemon_log
auth.info /var/adm/syslog/auth_log
lpr.info /var/adm/syslog/lpr_log
security.info /var/adm/syslog/security_log

#############################################


Could you please explain the purpose of each line in detail?

[Patrick Wallek]

This has nothing to do with your original question.

However, 'man syslogd' should answer your questions.

[senthil_kumar_1]

Hi All,

I have learned some information about syslog.

The syslogd command reads and logs messages into a set of files described by the configuration file /etc/syslog.conf.

Normally only the log files available in /var/adm/syslog directory are configure in /etc/syslog.conf.

So if we stop the syslog daemon the log files available in /var/adm/syslog will not get updated. But all other logs (cron , sulog, automount log) will get updated, am i correct?

[Johnson Punniyalingam]

>>>So if we stop the syslog daemon the log files available in /var/adm/syslog will not get updated. But all other logs (cron , sulog, automount log) will get updated, am i correct?<<

NO

syslog.log -> (for system related logs,but some normal entry will added for daemons like,crond,inetd,ftpd,automout...etc) but in details logging are printed for cron,su,automount, see below locattions).

cron log -> ( /var/adm/cron/log -> crontab

su log -> switch user logs (/var/adm/sulog)

automount log -> /var/adm/automount.log

so in-short all (cron,su,automount) have there own logging file,

so if restart "syslogd" you can see OLDSyslog.log & syslog.log will only updated not others.

HTH,

Regards,
Johnson