Syslog report is no longer working

Unanswered Question
Sep 1st, 2009

My syslog was growing in large and I went ahead and took the following steps:

etc/logadm.conf

Changed one line from:

/var/log/syslog_info -C 8 -P 'Fri Aug 28 07:10:00 2009' -a 'kill -HUP `cat /var/run/syslog.pid`'

To:

/var/log/syslog_info -C 1 -P 'Fri Aug 28 07:10:00 2009' -a 'kill -HUP `cat /var/run/syslog.pid`'

-C <#> simply says how many copies to keep when rotating the /var/log/syslog_info file and I chose to keep one file instead of 8.

And ever since my syslog is hosed, I cannot run any report, all reports return empty, syslog automated action is broke too. Do I need to revert this change or did I break anything else. I'm on Solaris 9, LMS2.6 with RME 4.0.6.

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
Joe Clarke Tue, 09/01/2009 - 07:57

Using logadm is not supported. You should use the CiscoWorks logrot.pl script instead. You can get help on how to configure logrot by searching the Common Services context sensitive help for "logrot".

However, if you must use logadm, you must add the -c argument to the line. This will cause the file to be rotated without changing the inode number. If the inode number is changed, you will need to restart SyslogCollector and SyslogAnalyzer after rotating the file.

nawas Tue, 09/01/2009 - 09:00

Changing the file had unsubscribed my server from syslog collector (strange). I went ahead and subscribed it again and now syslog is workig. Thanks

Actions

This Discussion