trimming log files question and scripts for it

[Ben Prusinski]

Hi folks,

I need to trim log files on a regular basis under the /var directory on our server and still keep a track record of the most recent log files. So deleting them to zero via SAM is not an option. Any tips or scripts are greatly appreciated. Thanks

Ben Prusinski

[Pete Randall]

SAM also has an option to trim them to the "recommended size". I believe you can also customize this "recommended size"


Pete

[S.K. Chan]

One option is to use logrotate ..
http://hpux.connect.org.uk/hppd/hpux/Sysadmin/logrotate-2.5/

[Jeff Schussele]

Hi Ben,

SAM's Routine Tasks section on log files can do more than just null the file.

It can:
1)Trim to Zero
2)Trim to the recommended size (size is fully adjustable)
3)Trim to a line #
4)Trim to a percentage

If you want this fully scripted, why don't you initially use SAM & then check the SAM log (/var/sam/log/samlog) to see just what & how it's doing what it's doing. Then use those command as a template for your script.

Rgds,
Jeff

[James R. Ferguson]

Hi Ben:

Some of the log files in /var are in binary format. Most notably, 'var/adm/wtmp' and 'var/adm/btmp'. To trim, but retain some of their information you need to do the following:

# /usr/sbin/acct/fwtmp < /var/adm/wtmp > /tmp/wtmp

This converts the binary file to an ASCII formatted one which you may edit and convert back to binary:

# /usr/sbin/acct/fwtmp -ic < /tmp/wtmp > /var/adm/wtmp

You can perform similar manipulations with the 'btmp' data for "bad" logins.

See the man pages for 'fwtmp' for more information.

Regards!

...JRF...

[Michael Steele_2]

With system log files SAM is best since often times writing to the file has to be accounted for, but you can also use the 'split' command for non-system log files.

split -b 56m source dest
split -b 55752k source dest
split -b 55752316 source dest

All the above will render ~5 files when the source = 278761580 bytes.

[Ajit Natarajan]

Which HP-UX release?

For 10.x, there is a patch PHCO_20824. This installs the cleanup command which can trim SD log files.

Another space hog in /var is the content of patches whose superseding patches have been installed on the system. The cleanup command allows you to cleanup those as well.

In 11.x, you can use swmodify(1M) to achieve the latter effect. Look for the patch_commit option in the man page.

If your system crashed and a dump is saved in /var/adm/crash, that can take up a lot of space as well. If you and the HP support representative are done with analyzing the dump, you could consider removing them. They tend to occupy a lot of space as well.


Thanks.

Ajit
HP Gigabit Ethernet

[Ben Prusinski]

Hi all,

We are running version 11.00 of HP-UX on our HP 9000 server. I tried to use the option under SAM for trimming the log files

Routine Tasks->System Log Files->Actions->Trim-> To a Line Number

but I keep getting the error message
"As error occurred while trying to determine the number of lines in the log file "/var/adm/lp/lpdaemon.log. Log trimming actions cannot be performed for this file with the possible exception of a trim to zero bytes."

How do I fix this error? Thanks!

[Michael Steele_2]

First, we all live for points here and we're anxiously awaiting to see what you award and who. To award points use the drop down menu on each reply and select the appropriate number.

Regarding "...lpdaemon.log..."

Netserver comes up on a patch search and I'm not sure what that is. Could you provide the model of the server? Also, are you running enware? Enware also came up and the patch for enware is:

PHSS_21629.

Patches for lpdaemon are:

PHSS_23022, PHSS_23024

But there are 64 patches associated to SAM so you???ll have to review these from the "maintenance and support option > individual patches" options in the left margin.

If you???re running out of space in /var and you can???t patch then I believe it???s probably OK to zero out the /var/adm/lp/lpdaemon.log since you're sooo big. But, SAM has a tendency to use binary logs so you need to check for a file type first. Run:

file /var/adm/lp/lpdaemon.log

And if its ASCII text then init 1 or init S for run level 1 or single user mode and proceed with the zero out of the file. At init 1 or S the system is mostly quiet or static so the lpdaemon daemon won't be up. Then:

cat /dev/null /var/adm/lp/lpdaemon.log

???.to complete the zero out procedure.

Take a make_tape_recovery tape first and copy the file into /tmp or somewhere.

You can also try these commands to evaluate lpdaemon.log:

fuser /var/adm/lp
ps -ef | grep -i rlpdaemon
lsof -p pid (* rlpdaemon *)
ps -ef | grep -i lpdaemon.log

Finally, you can also head -3000 /var/adm/lp/lpdaemon.log > /tmp/file from init 1 or S.

If you do use the "...head -3000..." command at init 1, then you might be able to copy the contents back in to /var/adm/lp/lpdaemon.log and init 3, but without an OK from someone who absolutely knows at HP I'd just zero the thing out.