Delete OLD Syslog Entries

[joetobai]

Hi All,

We have IMC Plat 5.1, I would like to delete all syslog entries prior to the last few weeks. Is this possible ?, there is a syslog backup everynight which is nearly @ 8 Gigs. I want to get to a stage the Syslog entries are mangeable. Any help would be appreciated

Thanks

J

[LindsayHill]

Go to System -> System Configuration -> Data Export -> Syslog.

Change the export settings to suit.

You could also look at your sources of syslogs, and see if there are particularly noisy sources that could be changed. 

You should also really look at upgrading. 7.1 + latest patches has come a LONG way from 5.1. It's much nicer to use.

[joetobai]

Hi,

Thanks for the Reply, I have reduced the amount of logs coming in but all the old entries are still there.

Current Status

Syslog List(Total Number is 26283428, the max display number of items is 100000)

Syslog Data Export Settings

By Time

Threshold   3 Days                                     Export but those in last 2 days

[Vince00]

I recall and have used a feature within iMC to zap the whole trap database for a fresh start but cannot seem to locate it again... Does anyone know where that is and if it also applies to the Syslog table?

[LindsayHill]

You're thinking of this: http://kontrolissues.net/2012/05/30/hp-imc-mass-recover-active-alarms/ 

It can be used to clear active alarms. That's a bit different to clearing out old syslogs though - they should manage themselves.

[joetobai]

Got it sorted,

The problem was when the export ran the Database had to process all the entries in the syslog database (26 million) which meant the Log file became huge & hadn't enough space to grow. When there was an extra 50GiGs added to the Drive, the log file grew to 40+Gigs & completed the task. The log file cleared after the export.

 Total Sylsog entries 5,000

Thanks for the Help