Using syslogd to Configure Log File Rotation
My syslog.conf file contains the following record...
auth.debug /var/log/auth rotate files 12 time 1m compress
... and the /var/log directory contains the following files...
-rw-rw-r-- 1 root system 26397865 Sep 18 10:47 auth
-rw-rw-r-- 1 root system 311043 May 17 09:02 auth.0.Z
-rw-rw-r-- 1 root system 303586 Apr 16 22:50 auth.1.Z
-rw-rw-r-- 1 root system 298308 Mar 17 2013 auth.2.Z
-rw-rw-r-- 1 root system 307399 Feb 15 2013 auth.3.Z
-rw-rw-r-- 1 root system 345293 Jan 15 2013 auth.4.Z
-rw-rw-r-- 1 root system 310297 Dec 07 2012 auth.5.Z
-rw-rw-r-- 1 root system 282326 Nov 06 2012 auth.6.Z
-rw-rw-r-- 1 root system 254741 Oct 07 2012 auth.7.Z
-rw-rw-r-- 1 root system 243113 Sep 07 2012 auth.8.Z
-rw-rw-r-- 1 root system 484621 Aug 07 2012 auth.9.Z
-rw-rw-r-- 1 root system 232133 Jun 08 2012 auth.10.Z
-rw-rw-r-- 1 root system 315591 May 08 2012 auth.11.Z
Can anyone tell me why the log hasn't been rotated since May? My expectation was that, after 12 rotations, it would roll over. Am I misinterpreting the meaning of the parameters I specified?
auth.debug /var/log/auth rotate files 12 time 1m compress
... and the /var/log directory contains the following files...
-rw-rw-r-- 1 root system 26397865 Sep 18 10:47 auth
-rw-rw-r-- 1 root system 311043 May 17 09:02 auth.0.Z
-rw-rw-r-- 1 root system 303586 Apr 16 22:50 auth.1.Z
-rw-rw-r-- 1 root system 298308 Mar 17 2013 auth.2.Z
-rw-rw-r-- 1 root system 307399 Feb 15 2013 auth.3.Z
-rw-rw-r-- 1 root system 345293 Jan 15 2013 auth.4.Z
-rw-rw-r-- 1 root system 310297 Dec 07 2012 auth.5.Z
-rw-rw-r-- 1 root system 282326 Nov 06 2012 auth.6.Z
-rw-rw-r-- 1 root system 254741 Oct 07 2012 auth.7.Z
-rw-rw-r-- 1 root system 243113 Sep 07 2012 auth.8.Z
-rw-rw-r-- 1 root system 484621 Aug 07 2012 auth.9.Z
-rw-rw-r-- 1 root system 232133 Jun 08 2012 auth.10.Z
-rw-rw-r-- 1 root system 315591 May 08 2012 auth.11.Z
Can anyone tell me why the log hasn't been rotated since May? My expectation was that, after 12 rotations, it would roll over. Am I misinterpreting the meaning of the parameters I specified?
Do you know which version of syslogd you are running? Typically, log rotation is dealt with by a different process like newsyslogd or logrotate each with their own configuration files.
@Champloo: Not with AIX! AIX does not come with logrotate, syslogd has a builtin rotation facility instead.
Oh, I see. You can try troubleshooting by adding in a line that rotates a file every few minutes.
Make sure you restart, or refresh syslogd whenever you make any configuration changes.
Look in you messages for any errors.
Make sure you restart, or refresh syslogd whenever you make any configuration changes.
Look in you messages for any errors.
ASKER
A colleague of mine found the following:
http://www-01.ibm.com/support/docview.wss?uid=isg1IV43848
I haven't had a chance to apply the fix yet.
http://www-01.ibm.com/support/docview.wss?uid=isg1IV43848
I haven't had a chance to apply the fix yet.
You didn't mention that you're running PowerHA.
Do you run it since ~ May of this year, and is it at a level below 6.1.0.12? If so, the fix pointed to by the link might indeed help.
Please take note that the fix includes a full upgrade of HACMP/PowerHA to a higher level, not just a replacement of a few executables.
Good luck!
wmp
Do you run it since ~ May of this year, and is it at a level below 6.1.0.12? If so, the fix pointed to by the link might indeed help.
Please take note that the fix includes a full upgrade of HACMP/PowerHA to a higher level, not just a replacement of a few executables.
Good luck!
wmp
ASKER
We updated PowerHA at that time (i.e., in May). How can I determine the current level of PowerHA.
lslpp -l "cluster.es.server.rte"
To get the update history:
lslpp -h "cluster.es.server.rte"
HACMP does not always require that all filesets are on the same level.
To see all filesets and their levels:
lslpp -l | grep cluster
To get the update history:
lslpp -h "cluster.es.server.rte"
HACMP does not always require that all filesets are on the same level.
To see all filesets and their levels:
lslpp -l | grep cluster
ASKER
Are you saying that versions 6.1.0.12 and above have fixed the problem?
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
"files 12" means that 12 files will be kept in the rotation.
"12 files" are present, so this part is obviously OK.
It seems just as if the machine (or syslogd) has been down during July 2012 as well as June, July and August 2013, so that rotation could not take place.
Could this be possible?