syslog.log file

[mhbd]

syslog.log file in hp-ux system contains various logs with timstamp without year. Can anyone help to modify syslog daemon to include Year in syslog .log file.

Thanks.

[Jeff_Traigle]

No option I'm aware of will place the year in the timestamp.

[Charles Harris]

Hi,

You could try using a replacement, I can't remeber if it supports year logging but it maybe worth a look:
http://hpux.cs.utah.edu/hppd/hpux/Networking/Admin/syslog_ng-1.6.7/

[Carlos Roberto Schimidt]

Dont make sense put year in syslog.log, because syslog is clear after ever boot.

I used to rotation my logs, where I use as sufix a timestamp.

[Charles Harris]

Carlos,

You reboot your HPUX servers!? ;-P

sorry, couldn't resist.

[Victor BERRIDGE]

Hi
I agree with the previous, at each reboot it started again and if you dont reboot the size of the file will make almost unusable...
You can adopt a logrotate strategy, or if paranoid (like me) write your own trimming system and stop/start your syslog from time to time in order to have some archives...


All the best
Victor

[A. Clay Stephenson]

One option is to use the "ng" (Next Generation) of syslog. It replaces the existing syslogd. It is much more configurable and you could modify the source to format the log messages any way you like.

http://hpux.cs.utah.edu/hppd/hpux/Networking/Admin/syslog_ng-1.6.7/

The downside to "improving" the message format is that you will like break any scripts or programs that expect the standard format.

[Victor BERRIDGE]

Also,
There is nothing stopping you to add a cron job that writes to syslog.log every day(/week/month) say at 1 AM doing a date>>/var/adm/syslog/syslog.log ....

[Carlos Roberto Schimidt]

Charles,

Yes, I do. You never reboot your server?

I have a problem with vpar where was developed specific patch for workaround, but I will have to aplly new version from vpar (february/2006), because i work with very large configuration where happen problems wich nobody still pass.

You can install new version form VPAR without reboot? If you can, congratulations.

But I have SG for avoid unavailability.

sorry, couldn't resist too.