Basic Q #2: How to rotate log files

[Trever Furnish]

Second easy points question...

What is the most typical, standard, supported method of keeping rotated logs online under HPUX11.00? How does everyone here do it?

In other words, I want one log file per day for the past 90 days or so, for the syslog and maillog, and one log file per year for the past 5 years for the shutdownlog. These are just fictitious examples.

I know the open source logrotate package can be compiled to work under HPUX, but is there a "more HP way"?

[harry d brown jr]

Trever,

Good source of INFO:

http://ark.sourceforge.net/logfile-mgmt.html

live free or die
harry

[harry d brown jr]

Trever,

Here's a sample of rotating SYSLOG.LOG:

Here's some example code that uses these parameters:

use Logfile::Rotate;
$logfile = new Logfile::Rotate(
File => "/var/adm/log/syslog",
Count => 5,
Gzip => "/usr/local/bin/gzip",
Signal =>
sub {
open PID, "/etc/syslog.pid" or
die "Unable to open pid file:$!\n";
chomp($pid = );
close PID;
# should check validity first
kill -HUP $pid;
}
);


from:
http://www.oreilly.com/catalog/perlsysadm/chapter/ch09.html


or another site for log rotation:
http://www.interhack.net/projects/rotatelog/

live free or die
harry

[Craig Rants]

You could also create some custom scripts, the one here looks to see if it is the last day of the month and then archives things. You would put 28-31 in the day column of your crontab entry.

#!/bin/sh
# variables
MON=`date +%m`
SERVER=`hostname`
LOG=/tmp/log

# Test to see if it is the last day of the month
if test `TZ=MET-24 date +%d` = 01
then
# Start the cd archive process
rm $LOG

# Record the start time
START=`date +%HH%MM`

# Copy last months files to temp directory
cp /log2/log1.$MON* /log2/cdfiles
cp /log2/log2.$MON* /log2/cdfiles
cp /log2/log3.$MON* /log2/cdfiles
cp /log2/log4.$MON* /log2/cdfiles
cp /log2/log5.$MON* /log2/cdfiles
cp /log2/log6.$MON* /log2/cdfiles
cp /log2/log7.$MON* /log2/cdfiles

# compress files before movement
for i in `ls /log2/cdfiles`
do
gzip /log2/cdfiles/$i
done

# obtain total file number and size
COUNT=`ls /log2/cdfiles | wc -l`
SIZE=0
for size in `ls -al /log2/cdfiles | awk '{ print $5 }'`
do
SIZE=`let "$SIZE + $size"`
done

# secure copy the files to appoc15 for CD archiving
/usr/local/bin/scp /log2/cdfiles/* servername:/usr4/asd/logs/$SERVER

# Record Stop Time
STOP=`date +%HH%MM`

# Generate a report and send it to Craig
if [ $? != "0" ]
then
/usr/sbin/sendmail craig@domain.com < /usr/home/rantsc/fail3.out
else
cat /usr/home/rantsc/pass3.out >> $LOG
echo "The script started at $START" >> $LOG
echo "The script stoped at $STOP" >> $LOG
echo "There are $COUNT files from $SERVER" >> $LOG
echo "The total file size is $SIZE (in bytes)" >> $LOG
/usr/sbin/sendmail craig@domain.com < $LOG
/usr/local/bin/ssh servername "touch /usr4/asd/chkdir/$SERVER"
rm -rf /log2/cdfiles/*
/usr/local/bin/scp /log2/$SERVER.* servername:/usr4/asd/90day/$SERVER
fi
else
echo "It is not the last day of the month" >> $LOG
fi

Now this is not an complete solution, just another way that things could be done if you chose to.

GL,
C

[Trever Furnish]

Thanks. Those are both helpful.

Is there no mechanism for doing part of this distributed with the HPUX OS, ie some rc.config.d variable that can be changed to tell the OS to save 10 versions of syslog.log instead of 1? I suppose I could just cp the old log and then mv it for X days.

Hmmm... I also suppose in retrospect that if that's good enough to make me happy then that's easy enough to implement, so I shouldn't have asked the question. :-)

Then again, I was asking because I thought there might already be a standard hpux way I just didn't know about, so I guess the answer is "No, because it's so simple." :-)

Thanks again.

[Patrick Wallek · Accepted solution]

If you look in the 'start' section of the /sbin/init.d/syslogd file, you will see that it does a move of /var/adm/syslog/syslog.log to /var/adm/syslog/OLDsyslog.log. This is done every time syslog is started with '/sbin/init.d/syslogd start' which is usually on a reboot.

If you want to keep more copies of syslog than just OLDsyslog.log, you could change the mv command to something like:

mv /var/adm/syslog/syslog.log /var/adm/syslog/syslog.log.$(date +%m%d%Y).$(date +%H%M%S)

This will create a syslog.log file with the date and time appended to the end of it. This way you can keep multiple copies.