Trimming log files

[Sanjiv Sharma_1]

Hi,

What is the best method of monitoring the log files in the HP-UX System and trimming them?

Do you have any script which trimmes all the log files when the /var fs is 90% full?

Thanks,

[john korterman · Accepted solution]

Hi,
SAM has a good facility for trimming logfiles:
SAM -> Routine tasks -> System Log Files
where you can manually select files for trimming.

There is at least one script for trimming a logfile in this thread:
http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0x836cc1c4ceddd61190050090279cd0f9,00.html

But I would not recommend just to trim the log files if they are filling up; read them and find out why.

regards,
John K.

[Vicente Sanchez_3]

Hello,

Trim files is one thing you have to do when /var is nn% full, but also consider to check other things like adm/crash, tmp or adm/sw/save directories.

HTH, Vicente.

[Christian Gebhardt]

Hi

We uses the tool "prune", you can easily configure files to prune. Limits can be given in lines, or bytes.

Source code at

http://wuarchive.wustl.edu/languages/c/unix-c/sysadmin/

Chris

[Balaji N]

logrotate is the utility which does this on linux boxes. saw that there is a port available for the same on hpux.
see if this helps.

http://hpux.connect.org.uk/hppd/hpux/Sysadmin/logrotate-2.5/

-balaji

[Pete Randall]

I personally use SAM to trim the various log files, but I've rarely seen log s have that much influence on space in /var. You need to take a harder look at what's using up your /var space. Run "du -sk /var/*", then look at the largest directories in more detail. Use the cleanup command to commit superceded patches, freeing up space in /var/adm. Drill down into lower level directories using the "du -sk" command and find out where your problems really lie, then address them.


Pete

[John Meissner]

I use SAM to do this. it's located under Routine Tasks. SAM will show you the %full the size and the recommended size of the logs. just highlight the logs you want to trim and go to actions>trim>trim to recommended sizes.

Very quick

[twang]

I don't think we should auto-trim logfiles. I would suggest we should periodically check these logfiles(routine task of a system administrator) and trim them then. You may use following command:
tail - >tmplog; mv tmplog >

[Shannon Petry]

twang,

What you suggest to do will not work! The system log is not opened by a filehandle. Your idea would work in a different approach.

tail -1000 /var/adm/syslog/syslog.log >/tmp/tmpsyslog.log
cat /tmp/tmpsyslog.log > /var/adm/syslog/syslog.log


Please try what you suggested and see what happens. Dont worry, unless your /var is full it will not crash the system.

It's a good idea to test suggestions before posting them unless your sure they work ;)

Regards,
Shannon

[Jordan Bean]

We daily run this rather simple posix shell script to archive our syslogs (not rotate) for up to three months. It assumes that the syslogd configuration is in /etc/syslog.conf and that all active logs are in /var/adm/syslog. A similar procedure can be used to archive Apache logs.

The basic method is to move aside all the current, open logs, create new empty files, and send SIGHUP to syslogd to close the current files and open the new ones.