Logrot Issues

Answered Question
May 10th, 2010
User Badges:

Running LMS 3.2 - I have logrot configured to rotate the syslog.log file after 1GB, but it's not functioning. I have configured logrot via Common Services GUI & via the CLI script, but neither seem to work. Here is the contents of the logrot.conf file:




var backup_dir = c:\progra~2\cscopx\log

var delay =

C:\PROGRA~2\CSCOpx\log\syslog.log 20 1024000 gz

Correct Answer by Joe Clarke about 6 years 10 months ago

Logrot -v only enables verbose mode.  If it didn't work before my guess is that the file wasn't quite 1 GB yet.  It was just barely over 1 GB in this execution.  If you do see problems with logrot, running it with -v will show what logrot is doing at each step of the way.

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
Loading.
Joe Clarke Mon, 05/10/2010 - 21:41
User Badges:
  • Cisco Employee,
  • Hall of Fame,

    Founding Member

Port the output of:


C:\PROGRA~2\CSCOpx\bin\perl.exe C:\PROGRA~2\CSCOpx\bin\logrot.pl -v

readytolearncisco Tue, 05/11/2010 - 01:44
User Badges:

It looks like that did the trick. Does the 'v' option force enable logrot? Also, considering I have a 365 day purge setting, will RME be able to report on the logs within the rotated/compressed files or only on the actual syslog.log file?


Thanks Joe!






C:\PROGRA~2\CSCOpx\bin>perl.exe C:\PROGRA~2\CSCOpx\bin\logrot.pl -v

Tue May 11 03:41:30 2010: INFO: Read variable backup_dir --> c:\progra~2\cscopx\

log

Tue May 11 03:41:30 2010: INFO: Read variable delay -->

Tue May 11 03:41:30 2010: INFO: Logfile = C:\PROGRA~2\CSCOpx\log\syslog.log, Bac

kup File = c:\progra~2\cscopx\log\syslog.log

Tue May 11 03:41:30 2010: INFO: Archiving C:\PROGRA~2\CSCOpx\log\syslog.log (fil

e size = 1167511841, conf size = 1048576000)

Tue May 11 03:41:30 2010: INFO: Rolling logfile archive.

Tue May 11 03:41:30 2010: INFO: Archiving C:\PROGRA~2\CSCOpx\log\syslog.log to c

:\progra~2\cscopx\log\syslog.log.0.

        1 file(s) copied.

Tue May 11 03:41:32 2010: INFO: Compressing c:\progra~2\cscopx\log\syslog.log.0

using gzip -f

Tue May 11 03:42:25 2010: INFO: Rotating C:\PROGRA~2\CSCOpx\log\syslog.log.

Correct Answer
Joe Clarke Tue, 05/11/2010 - 14:39
User Badges:
  • Cisco Employee,
  • Hall of Fame,

    Founding Member

Logrot -v only enables verbose mode.  If it didn't work before my guess is that the file wasn't quite 1 GB yet.  It was just barely over 1 GB in this execution.  If you do see problems with logrot, running it with -v will show what logrot is doing at each step of the way.

readytolearncisco Tue, 05/11/2010 - 15:25
User Badges:

Understood. As far as RME being able to report on the arhived/compressed files, is this true, or can RME only report on the contents of the

currently uncompressed/active syslog.log file? I have a purge setting of 365 days, and would like to be able to access up to the full 365 worth of syslog on each device. Thanks Joe.

Joe Clarke Tue, 05/11/2010 - 21:41
User Badges:
  • Cisco Employee,
  • Hall of Fame,

    Founding Member

Once the messages are read from the syslog.log, they are stored in the RME database.  Only those messages will be seen in the syslog reports.

After the messages have been inserted into the database, you can do whatever with the log file.  The ability to run reports on older syslog messages depends on the purge policy you have setup for the syslog messages under RME > Admin > Syslog > Set Purge Policy.

readytolearncisco Wed, 05/12/2010 - 03:23
User Badges:

This brings up another question...if the syslog messages within the syslog.log file is pulled into RME and is no longer seen from within syslog.log itself, does it even really matter what the size of the syslog.log file is?

Actions

This Discussion