cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
4079
Views
15
Helpful
34
Replies

Syslog.log getting too large!!!

jeeyishyuan
Level 1
Level 1

Hi Experts,

My syslog.log file size is getting too large (about 9GB) within a month. Is there a way for me to run any job for me to archive syslog.log and compress it in a smaller file size?

Thanks and Regards,

Yi Shyuan

2 Accepted Solutions

Accepted Solutions

Joe Clarke
Cisco Employee
Cisco Employee

Yes, you can configure logrot.pl to periodically rotate and archive the syslog.log file. Search the Common Services online help for "logrot" for more on how to configure and schedule it.

View solution in original post

Your Collector.properties is till pointing to NMSROOT\log\syslog.log. If your active syslog message file is a different file, you need to update the SYSLOG_FILES property in Collector.properties, then restart SyslogCollector and SyslogAnalyzer.

View solution in original post

34 Replies 34

Joe Clarke
Cisco Employee
Cisco Employee

Yes, you can configure logrot.pl to periodically rotate and archive the syslog.log file. Search the Common Services online help for "logrot" for more on how to configure and schedule it.

Hi Joe,

How should i specify the backup directory in edit variables? What number should i be inputting?

Thanks & Regards

YS

The backup directory is wherever you want it to be. This is where archives will be stored, so it needs to have enough space to hold them all. The number of revision is again, left up to you. How many old revisions do you want?

Hi Joe,

Thanks for the reply. I get what you mean now. But is it possible for me to automate or schedule this job to be run?

Thanks & Regards,

YS

From the Common Services User Guide

(http://www.cisco.com/en/US/docs/net_mgmt/ciscoworks_common_services_software/3.2/user/guide/cs32ug.html)

Chapter 4 Configuring the Server

Administering Common Services

(pages 4-102 and 103), logrot works as follows:

Running Logrot Script

To run the Logrot Script enter:

• On Windows:

Enter NMSROOT\bin\perl NMSROOT\bin\logrot.pl

• On Solaris:

Run /opt/CSCOpx/bin/logrot.pl

You can schedule log rotation so that the utility works on a specified time and day.

Hope this helps. Please rate this post if it does.

- Marvin

If you have LMS 3.1, you can schedule logrot from the Log Rotation screen. Else, here are the instructions:

logrot is typically run from UNIX cron or Windows AT. However, before

automating logrot, you should verify it runs on-demand. For example, to

run logrot on UNIX:

/opt/CSCOpx/bin/logrot.pl

and on Windows:

NMSROOT\bin\perl.exe NMSROOT\bin\logrot.pl

Once you've verified things work on-demand, you can setup cron on UNIX:

0 1 * * * /opt/CSCOpx/bin/logrot.pl 2>&1 | /usr/lib/sendmail root

or AT on Windows:

at 01:00 /every:M,T,W,Th,F,S,Su C:\progra~1\CSCOpx\bin\perl.exe C:\progra~1\CSCOpx\bin\logrot.pl

(This assumes CiscoWorks is installed in the default location on Windows.)

Those commands will run logrot every day at 1:00 AM. The UNIX cron line will

also send all output of the command to root via email.

logrot accepts some command-line flags as well. If you pass -v to logrot,

logrot will output verbose messages as it runs. The -s option tells logrot

to shutdown dmgtd before rotating the logs. This can be a safer way of

doing log rotations (see the BUGS section below). The -c option can be

specified at any time to re-run the configurator.

Hi Joe,

Just would like to check with you, how can I view the scheduled job status in LMS login page (GUI)? When logrot job is started to run, will the syslog service and daemon manager being shutdown automatically?

Or is there such a need to stop syslog service for every logrot job to be done? As I realized the syslog collector status will be reset each time I shut down the crmlog service.

A crmlog error 1067 also encountered recently. Any way to correct it?

Regards

Yi Shyuan

If you have schedule logrot to run using AT or cron, then there is no way to see its progress in LMS.

If you configure logrot to do an offline rotation (logrot.pl -s) then Daemon Manager will be shutdown. For some log files, it is necessary to do an offline rotation in order to properly rotate them.

I do not know what a 1067 error is. What other details did you get? When did you get this error? What were you doing?

Hi Joe,

I am running logrot for syslog.log, will offline rotation be necessary? How can I configure the scheduled logrot job to run offline rotation? How can I cancel logrot schedule job?

The error 1067 is encountered each time when I stop and start crmlog. Is stopping crmlog necessary when I am running logrot on syslog.log?

Regards

YS

No, restarting crmlog is not necessary. However, this error could point to some other process binding to udp/514.

Just run logrot.pl -s to run an offline rotation. Logrot will handle automatically restarting Daemon Manager.

To cancel an AT job, just run:

AT ID /delete

Where ID is the ID of the schedule AT job. To cancel a cron job, just remove the entry from the crontab file.

Hi Joe,

How would advise me for the error I encountered when I stop and start CWCS Syslog service as my syslog collector status is not reset and number of syslog messages are now read as NA and the up time is not reachable. Please refer to the screen shot attached for more info.

Thanks n Regards,

YS

These numbers have nothing to do with crmlog. These point to a problem with SyslogCollector and/or SyslogAnalyzer. Try:

pdterm SyslogCollector SyslogAnalyzer

pdexec SyslogCollector SyslogAnalyzer

Hi Joe,

What should I be expecting from running this two commands? I don't see any output after running them.

Regards

YS

You shouldn't. That just restarts those processes. Check your Syslog Collector Status.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: