SYSLOG configuration

Unanswered Question
Jun 16th, 2009
User Badges:

Dear ALL,


I am facing the issue in the syslog features, the details are given below:


Log setting configuration in LMS is C:/------Primary folder the size 100MB and number of revisions is 10.


But in My c:/ folder the syslog file size is increasing to 1.8 gig . my syslog file setting is 100MB.


The syslog file is working the revisions (0-9).but the size of the file is not maching with our setting (100MB).


I did the logrotation configuration by GUI.

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 4 (1 ratings)
Loading.
Joe Clarke Tue, 06/16/2009 - 08:53
User Badges:
  • Cisco Employee,
  • Hall of Fame,

    Founding Member

Post your NMSROOT/objects/logrot/logrot.conf file. What version of LMS are you using?

Joe Clarke Wed, 06/17/2009 - 08:15
User Badges:
  • Cisco Employee,
  • Hall of Fame,

    Founding Member

What is the output of NMSROOT/bin/perl NMSROOT/bin/logrot.pl -v?

subashmbi Wed, 06/17/2009 - 21:12
User Badges:

Hi Clarke,


Please find the logrot.pl output.


C:\PROGRA~1\CSCOpx>cd bin

C:\PROGRA~1\CSCOpx\bin>perl C:\PROGRA~1\CSCOpx\bin\logrot.pl -v

Thu Jun 18 08:16:21 2009: INFO: Read variable backup_dir --> D:\BackupSYSlog\

Thu Jun 18 08:16:21 2009: INFO: Read variable delay --> 60

Thu Jun 18 08:16:21 2009: INFO: Logfile = D:\BackupSYSlog\syslog.log.0\syslog.lo

g, Backup File = D:\BackupSYSlog\\syslog.log

C:\PROGRA~1\CSCOpx\bin>C:\PROGRA~1\CSCOpx\bin

subashmbi Thu, 06/18/2009 - 01:48
User Badges:


Hi clarke ,


Sorry , the previous post u can ignore the output.


Please find the below updated output:-


C:\PROGRA~1\CSCOpx>cd bin

C:\PROGRA~1\CSCOpx\bin>perl C:\PROGRA~1\CSCOpx\bin\logrot.pl -v

Thu Jun 18 12:49:34 2009: INFO: Read variable backup_dir --> D:\BackupSYSlog\

Thu Jun 18 12:49:34 2009: INFO: Read variable delay --> 60

Thu Jun 18 12:49:34 2009: INFO: Logfile = D:\BackupSYSlog\syslog.log.0\syslog.lo

g, Backup File = D:\BackupSYSlog\\syslog.log

Thu Jun 18 12:49:34 2009: INFO: Logfile = C:\PROGRA~1\CSCOpx\log\syslog.log, Bac

kup File = D:\BackupSYSlog\\syslog.log

Thu Jun 18 12:49:34 2009: INFO: Archiving C:\PROGRA~1\CSCOpx\log\syslog.log (fil

e size = 862074975, conf size = 102400000)

Thu Jun 18 12:49:34 2009: INFO: Rolling logfile archive.

Thu Jun 18 12:49:34 2009: INFO: Archiving C:\PROGRA~1\CSCOpx\log\syslog.log to D

:\BackupSYSlog\\syslog.log.0.

1 file(s) copied.

Thu Jun 18 12:52:26 2009: INFO: Rotating C:\PROGRA~1\CSCOpx\log\syslog.log.

Joe Clarke Thu, 06/18/2009 - 08:23
User Badges:
  • Cisco Employee,
  • Hall of Fame,

    Founding Member

This looks good. The C:\PROGRA~1\CSCOpx\log\syslog.log should have been truncated to 0 bytes. You should now only see messages in this filed dated after Jun 18 12:49:34 2009.

dknov Fri, 06/19/2009 - 13:35
User Badges:

Hi,


I have exactly the same problem, however when I try run the logrot.pl it just comes back to command line without printing any output and the log file size stays the same.


Any ideas why?


I am running LMS 2.6.


Thanks!

David

Joe Clarke Fri, 06/19/2009 - 20:54
User Badges:
  • Cisco Employee,
  • Hall of Fame,

    Founding Member

Start a new thread for your problem.

prakashj Sat, 06/20/2009 - 22:14
User Badges:


Hi clarke,


We are observing the issue log rotation is increasing or not. I will update u the status of this thread.

subashmbi Sat, 06/20/2009 - 22:19
User Badges:

Hi clarke,


We are observing the issue log rotation is increasing or not. I will update u the status of this thread.



Regards

Subash

subashmbi Sun, 06/21/2009 - 02:50
User Badges:


Today the file has again increased to 129MB, our configured size is 100MB.


The rmeeng file syslog db is related to this syslog rotation. Kindly advice.


C:\Program Files\CSCOpx\databases\rmeng

SyslogFirst.db Size 8,929,292 KB Date 6/16/2009

SyslogSecond.db Size 23,684,808 KB Date 6/20/2009

SyslogThird.db Size 3,139,272 KB Date 6/14/2009


Sun Jun 21 10:57:44 2009] Backing up database rmengdb:SQL Anywhere Command File Hiding Utility Version 10.0.1.3694

SQL Anywhere Backup Utility Version 10.0.1.3694

Database backup failed

Backup is unable to open database file 'SyslogFirst.db'

[Sun Jun 21 10:57:45 2009] Backup rmeng to D:/\0\rmeng\database\rmeng.db failed. Retry backup database rmeng

SQL Anywhere Command File Hiding Utility Version 10.0.1.3694

SQL Anywhere Backup Utility Version 10.0.1.3694

Database backup failed

Backup is unable to open database file 'SyslogFirst.db'

[Sun Jun 21 10:58:45 2009] Backup rmeng to D:/\0\rmeng\database\rmeng.db failed second time.

[Sun Jun 21 10:58:45 2009] ERROR(1101): Database rmengdb backup failed and . Check the log file for information.

[Sun Jun 21 10:58:45 2009] Backup failed: 2009/06/21 10:58:45

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!



Joe Clarke Sun, 06/21/2009 - 10:30
User Badges:
  • Cisco Employee,
  • Hall of Fame,

    Founding Member

Logrot is scheduled. For example, if you schedule logrot to run every day at midnight, it is possible for syslog.log to grow to a size greater than the configured rotation size within the 24 hour period where logrot is not running. However, when logrot runs again, it will rotate the log (reducing the size back to 0 bytes momentarily).


No, logrot has nothing to do with the syslog data spaces. It does appear that at least one of your syslog data spaces is corrupt, though. You should restore LMS from a known good backup to recover from this.

subashmbi Sun, 06/21/2009 - 21:26
User Badges:


Thanks Clarke,


Any workaround is to reducing the size of the syslog.db file.




I can use the syslog.db file from the orig folder and the existing file rename to .backup .Kindly advice me .

Joe Clarke Sun, 06/21/2009 - 21:46
User Badges:
  • Cisco Employee,
  • Hall of Fame,

    Founding Member

You can contact TAC to get the DBSpaceReclaimer.class utility. However, if your syslog data spaces are corrupt, that utility will not work. You will need to restore LMS from a known good backup first to get a consistent RME database.

subashmbi Sun, 06/21/2009 - 23:45
User Badges:


Thanks clarke,


We are trying with recent back db file. I will update u .



subashmbi Mon, 06/22/2009 - 21:15
User Badges:


After we restored the syslog.db from good backup. the below error we are getting:-


Forbidden

You don't have permission to access /cwhp/cshome.do on this server.


Additionally, a 403 Forbidden error was encountered while trying to use an ErrorDocument to handle the request.

Joe Clarke Mon, 06/22/2009 - 22:00
User Badges:
  • Cisco Employee,
  • Hall of Fame,

    Founding Member

You can't simply restore one file from a backup. You need to restore the entire backup using the restorebackup.pl script.

subashmbi Tue, 06/23/2009 - 00:22
User Badges:

Hi clarke,


can u send me the command syntax of the restorebackup.pl script.But this command will restore the whole database. any other workaround is for restoring only RME database.


Now we are facing the issue the rmeeng service in the control panel is intermittentily working Start/stop.



Joe Clarke Tue, 06/23/2009 - 07:20
User Badges:
  • Cisco Employee,
  • Hall of Fame,

    Founding Member

The command will be something like:


NMSROOT/bin/perl NMSROOT/bin/restorebackup.pl -d /path/to/backup -gen GEN


Where /path/to/backup is the location of your backups, and GEN is the generation number you wish to restore. This command will restore EVERYTHING in LMS. There is no way to do a partial restore.

Actions

This Discussion