logs to check

[bond007]

Hello,

Iam new to HP Unix, could you please suggest the various logs to check in a HP unix server for diagnoizing problems/performance.

Thanks in advance,

Bond.

[Tomek Gryszkiewicz · Accepted solution]

The most important are in /var/adm/ and also in root's mail

[MarkSyder]

Daily checks:

cd /var/adm
ll btmp (bad login attempts - check in case of people trying to hack into your system)
ll sulog (switch-user log - check in case it grows large and takes up too much space)
ll wtmp (successful user logins)

ll cron (scheduled jobs - log may grow large)
ll lp (print log - may grow large)

cd syslog
ll

Check the size of mail.log in case it grows large.

grep -Ei "warning|error" syslog.log - check for problems in the system log. You may like to read syslog.log to see what (if anything) is going wrong.

Trim syslog.log via SAM every day so you're not reading the same errors the next day.

Mark Syder (like the drink but spelt different)

[Muthukumar_5]

Primary log is,

1) /var/adm/syslog/syslog.log

it may differ based on /etc/syslog.conf

2) dmesg

which is more important.

3) /var/adm/

directory is containing different logs.

--
Muthu

[Sivakumar TS]

Dear bond,

The /var/adm/syslog/syslog.log has the current log and

/var/adm/syslog/OLDsyslog.log has the previous boot error log.

With Regards,

Siva.

[Asif Sharif]

Hi,
you can check these logs on periodic basics.

#ll /var/adm
#dmesg
#tail -100f /var/adm/wtmp
#tail -100f /var/adm/btmp
#tail -100f /var/adm/syslog/syslog.log
#tail -100f /var/adm/cron/log
#tail -100f /var/adm/syslog/mail.log

Regards,
Asif Sharif

[MarkSyder]

I would caution against tail -f on these files. This is a dynamic command: i.e. you will see entries as they are added. tail -100f syslog.log will show you errors that have taken place in the last 100 lines and new errors as they happen. What if you had a system error that is 101 lines back in the syslog?

Furthermore, btmp and wtmp are data files, so tail is of limited value on them.

Mark

[Chan 007]

Bond007,

Startup log - /etc/rc.log - provides information regarding system boot related messages.

System log (Provides most of the information) - /var/adm/syslog/syslog.log

Check Dmesg

Check Sulog, wtmp etc from secutiry side.

Chan

[Sivakumar TS]

Dear bond,

You can also login to MP and get the logs

forward process log
error log

etc.

With Regards,

Siva.

[Bharat Katkar]

Would like to add two more:

1. /etc/shutdownlog
2. /var/adm/sw

First one tells you the reason for shutdown and the second one contains different log files for SDUX (Software Management).

Regards,

[Indrajit_1]

Hi;

#dmesg
#cat /var/adm/syslog/syslog.log
#strings /var/adm/wtmp
#strings /var/adm/btmp
#cat /etc/shutdownlog

etc...


Cheers
Indrajit

[Sivakumar TS]

Hi Bond,

If the machine has STM installed, then you may run cstm --> logtool and collect the event logs.

With Regards,

Siva.

[Steven E. Protter]

Shalom bond,

#tail -100f /var/adm/wtmp
#tail -100f /var/adm/btmp

Won't work.

These two files store data in a binary format.

To get meaningful output you should use the last and lastb commands.

To get useful output from these raw files the output needs to be run through strings command.

SEP

[shridhar_1]

hi bond

more /var/adm/syslog/syslog.log | grep -i error

more .....| grep -i warn
more ///sylo... | grep -i fail

last -R | more

dmesg

/var/mail/root


hth

shri