Can I delete/nullify this file ?

[rveri]

Hi All ,

found /var is 100% . hp-ux 11i.

Also found /var/opt/ids/error.log is 2231MB.

-rw------- 1 ids ids 2240241664 May 24 23:26 error.log


Q: What is this file ? can i nullify it.

Please suggest,
Thanks,

[Arunvijai_4]

Hi,

You can do it with, # >/var/opt/ids/error.log

-Arun

[Patrick Wallek · Accepted solution]

I would first actually take a look at the log file to see if there is anything in it you should know about.

Log files do not normally get that large without a reason.

Judging from the user id that owns the file and the directory that it is in, I would guess that this log file belongs to some type of IDS (Intrusion Detection System). It could be part of HP's HIDS software.

Do an 'fuser -u error.log' to see what process is accessing the file and then do a 'ps -ef' and look for that process id to see what the actual process is. From there you should be able to determine what the software is that is using this file.

Again, please do not just clear out a log file because it grows too big. You need to understand WHY it is growing so large first so you can fix any problems and hopefully prevent them in the future.

[Raj D.]

Hi,

/var/opt/ids/error.log :
This file is from hp-ux Host Intrusion Detection system software, and can be nullified if causing filesystem to full.
But as Patrick said you must check the cause of it .


Cheers,
Raj.

[rveri]

Thanks ,

I have nullified it and now /var reduced to 33% .

But I found this file is still growing in fast rate , 124MB so far in just 10 min.

-rw------- 1 ids ids 124520456 May 25 00:00 error.log


Patrick ,
here is the output of # fuser -u error.log

# [/var/opt/ids] fuser -u error.log
error.log: 20754o(ids) 20756o(ids) 20755o(ids)


Any help is highly appreciated,

Thanks,

[rariasn]

Hi rveri,

# ps -fu ids

# /sbin/init.d/idsagent stop

# mv /var/opt/ids/error.log /var/opt/ids/error.log.old

# compress /var/opt/ids/error.log.old

# /sbin/init.d/idsagent start

Verify file /etc/rc.config.d/id

# HP-UX Host IDS configuration.
#
# IDS: Set to 1 to start idsagent daemon on boot
# By default we set it to 0 so that the idsagent startup
# is SKIPed at system boot.
# The IDS_importAgentKeys script will reset the flag
# to 1 once all certificates are generated.
#
IDS=1

If IDS=0 not start process ids agent.

rgs,

ran

[Darrel Louis]

Hi,

If a log file is growing rapidly, always check what is the root cause.

To rotate your logfile, create a script to rotate the logfile regurarly, via cron.
Also check for the logrotate tool.

Darrel