log files

[Ali Imran Abbas]

I need some information about the log files. If they grow big, how can you truncate them. I had a cron log file in /var/adm/cron/log. I coppied it to oldlog and removed the original one. Then created another log file with the same name and sets of permissions, but cron is not writing to it. Can any one help me in this regard.

Regards,

Ali

[Pete Randall · Accepted solution]

You need to stop and restart your cron process:

/sbin/init.d/cron stop
/sbin/init.d/cron start

In the future, I would suggest using SAM to trim your log files.


Pete

[Torsten.]

Use

sam
-> routine tasks
-> system log files
(select the log)
-> Actions -> trim


but there are so many other ways too ...


BUT never delete the file!

[Ali Imran Abbas]

HEy ,
I tried doing this, but it gives me an error.

usunx08:# cron stop
usunx08:# ! cron is already running Thu Jan 24 11:35:31 EST 2008
! ******* CRON ABORTED ******** Thu Jan 24 11:35:31 EST 2008

usunx08:#

Any suggestion in this regard?

[TTr]

The log file that you removed was in "open" state by the cron daemon. You must NEVER remove an open file. Almost each and every time, removing an open file will hung the process that has that file open.

In your case you must restart cron.

In general before removing a file you check it using the "fuser" command. The fuser command will show you if the file is open and which process has it open.

Some daemons will listen to a HUP signal to reread their config environment. These are syslogd, crond etc.

The standard method for rolling a syslog log file is

1) mv syslog.log syslog.log-old (the move command does not impact an open file. The new name is still open by the same process and still being logged on)
2) kill -HUP
A new syslog.log will be created.

Using this method, there is no interuption in the daemon coverage. If you restart a daemon you will have a 3-5 seconds of no-daemon service. It depends how critical you server environment is.

[Torsten.]

/sbin/init.d/cron stop

/sbin/init.d/cron start

[Pete Randall]

Ali,

Not sure why you had problems. This works for me:

# /sbin/init.d/cron stop
cron stopped
# /sbin/init.d/cron start
cron started


Pete

[James R. Ferguson]

Hi:

Using the '/sbin/init.d/cron' script to stop and (re)start your cron daemon has the advantage that the current '/var/adm/cron/log' is moved to '/var/adm/cron/OLDlog' and the 'cron' daemon restarted when the script's argument is "start". You can then compress or remove the 'OLDlog' as you see fit.

There is NO PROBLEM with removing an open file! In fact, it is a common technique to open a temporary file and immediately 'unlink()' it. A file's disk space remains inuse until the last process referencing it terminates and the in-use count decrements to zero. Moving a file with 'mv' retains the inode number of a file but allows its name to be changed. Thus the association between a process and the inode remains and in the case of log files, the logging continues.

Regards!

...JRF...

[Robert-Jan Goossens]

Hi Ali,

Are you sure you are on a HPUX box?

usunx08

If this a sun try

# /etc/init.d/cron stop
# /etc/init.d/cron start

Regards,
Robert-Jan