Old Syslog previous matter deleted in hp-ux 11.23

[Surajit Santra]

I have rx 6600 server with Itaniam Processor in hp-ux 11.23. While the server rebooted the previous contain of Oldsyslog was deleted and the curretn syslog contain updated in oldsyslog in /var/adm/syslog. So how retrive the oldsyslog contain before the server rebooted and also how to rectify the issue of oldsyslog (preserve the contain)?

[Matti_Kurkela]

The only way is to restore the old /var/adm/syslog/OLDsyslog.log file from backups. If you don't have a backup, the old file is now gone forever.

The standard HP-UX startup scripts will move the previous /var/adm/syslog/syslog.log to /var/adm/syslog/OLDsyslog.log while the system is booting, destroying the older OLDsyslog.log file if it exists. If you want to preserve the logs, you must either:

1.) make a custom startup script that will move the OLDsyslog.log file away to a safe location each time the system boots, so that there will be no need to overwrite OLDsyslog.log when the system boots next time,

or

2.) use /etc/syslog.conf to configure syslog to write to some other file which is not cleared by standard startup scripts.

MK

[Ganesan R]

Hi Surajit,

This is the normal process /sbin/init.d/syslogd daemon will do. Whenever system reboots syslog.log file will be moved to OLDsyslog.log and previous OLDsyslog.log will be overwritten.

If you wish to preserve OLDsyslog.log, you should set up cron job to take backup of syslog/OLDsyslog files on daily basis or need to modify the syslogd daemon to backup OLDsyslog.log before it overwrites.

[SUDHAKAR_18]

Hi,

Before rebooting the system, Move the Oldsyslog to any other name with date.

This is the simple procedure to preserve oldsyslog.