Question about some log files

[Waqar Razi]

I have question about some log files under /var file system. They are:

1- /var/stm/logs/sys/diaglogd_activity_log

2- Under /var/stm/logs/os, follwoing files:

-rw-r--r-- 1 root root 1880 Aug 17 2005 log1.fmt1
-rw-r--r-- 1 root root 1880 Aug 17 2005 log1.fmt2
-rw-r--r-- 1 root root 11321148 Aug 17 2005 log1.raw
-rw-r--r-- 1 root root 1018631 Jul 27 12:10 log2.fmt1
-rw-r--r-- 1 root root 51900816 Sep 29 20:59 log2.raw.cur
-rw-r--r-- 1 root root 32768 Oct 5 04:30 memlog

The questions I have about these files are as follows:

1- What kind of data these files contain?

2- How important they are?

3- Is there any utility to safely trim them?

Any help in this regard would be highly appreciated.

[Torsten.]

These are binary log files from the online diagnostics containing information about (hardware failure) events on your systems.

[Waqar Razi]

Can we safely trim them, one file /var/stm/logs/sys/diaglogd_activity_log is about 449 MB and is taking nearly one third of space on /var?

[Torsten.]

This should not be a problem.

[Waqar Razi]

Is there any utility to trim it off?

[Waqar Razi]

Lets say if I want to keep 30 to 40 days of data in this file, How can I do that?

[Adam W.]

you can clear the file by using the > symbol followed by the file name, but be cautious because this CLEARS or EMPTIES the file.

[Duncan Edmonstone · Accepted solution]

The big file ending in ".cur" is a binary STM log file. You can cause it to switch to a new log file by switching logs in STM. The following code snippet is a quick and easy way of doing this:

cstm << EOF
ru logtool
sl
ok
exit
ok
exit
ok
EOF

once a log has been switched, you can shift the old one off somewhere else, compress it or delete it - whatever you like.

HTH

Duncan

[Waqar Razi]

Hey Duncan

Thanks for your reply, Can you please provide me a little more detail about the switching and trimming process.

Regards

[Duncan Edmonstone]

So looking at the files you have listed above, the current log in use (and the one you care about cos its big) is log2.raw.cur

You can't tocuh this log normally cos its in binary format and still being written to. So the code snippet I posted will force diagnostics to start using another log, although that new logfile won't appear until a diagnostics event happend to create it. What you should see happen is that log2.raw.cur gets renamed to log2.raw and eventually a new file will be create called log3.raw.cur. At this point you can do waht you like with log2.raw - I would suggest moving it to somwehere with more space or backing it up. If you ever need to look at the contents of the log, then you have to go into cstm and start the logtool, select a raw log and then format it. To be honest I can't think I've ever needed to do this more than twice in 15 years of admin on HPUX. If you want to understand what's going on in logtool, look at the documentation here:

http://docs.hp.com/en/diag/stm/help/utility/logtoolc.htm

HTH

Duncan