Solved: Logrot Issues

readytolearncisco · ‎05-10-2010

Running LMS 3.2 - I have logrot configured to rotate the syslog.log file after 1GB, but it's not functioning. I have configured logrot via Common Services GUI & via the CLI script, but neither seem to work. Here is the contents of the logrot.conf file:

var backup_dir = c:\progra~2\cscopx\log

var delay =

C:\PROGRA~2\CSCOpx\log\syslog.log 20 1024000 gz

Joe Clarke · ‎05-11-2010

Logrot -v only enables verbose mode. If it didn't work before my guess is that the file wasn't quite 1 GB yet. It was just barely over 1 GB in this execution. If you do see problems with logrot, running it with -v will show what logrot is doing at each step of the way.

View solution in original post

Joe Clarke · ‎05-10-2010

Port the output of:

C:\PROGRA~2\CSCOpx\bin\perl.exe C:\PROGRA~2\CSCOpx\bin\logrot.pl -v

readytolearncisco · ‎05-11-2010

It looks like that did the trick. Does the 'v' option force enable logrot? Also, considering I have a 365 day purge setting, will RME be able to report on the logs within the rotated/compressed files or only on the actual syslog.log file?

Thanks Joe!

C:\PROGRA~2\CSCOpx\bin>perl.exe C:\PROGRA~2\CSCOpx\bin\logrot.pl -v

Tue May 11 03:41:30 2010: INFO: Read variable backup_dir --> c:\progra~2\cscopx\

log

Tue May 11 03:41:30 2010: INFO: Read variable delay -->

Tue May 11 03:41:30 2010: INFO: Logfile = C:\PROGRA~2\CSCOpx\log\syslog.log, Bac

kup File = c:\progra~2\cscopx\log\syslog.log

Tue May 11 03:41:30 2010: INFO: Archiving C:\PROGRA~2\CSCOpx\log\syslog.log (fil

e size = 1167511841, conf size = 1048576000)

Tue May 11 03:41:30 2010: INFO: Rolling logfile archive.

Tue May 11 03:41:30 2010: INFO: Archiving C:\PROGRA~2\CSCOpx\log\syslog.log to c

:\progra~2\cscopx\log\syslog.log.0.

1 file(s) copied.

Tue May 11 03:41:32 2010: INFO: Compressing c:\progra~2\cscopx\log\syslog.log.0

using gzip -f

Tue May 11 03:42:25 2010: INFO: Rotating C:\PROGRA~2\CSCOpx\log\syslog.log.

Joe Clarke · ‎05-11-2010

Logrot -v only enables verbose mode. If it didn't work before my guess is that the file wasn't quite 1 GB yet. It was just barely over 1 GB in this execution. If you do see problems with logrot, running it with -v will show what logrot is doing at each step of the way.

readytolearncisco · ‎05-11-2010

Understood. As far as RME being able to report on the arhived/compressed files, is this true, or can RME only report on the contents of the

currently uncompressed/active syslog.log file? I have a purge setting of 365 days, and would like to be able to access up to the full 365 worth of syslog on each device. Thanks Joe.

Joe Clarke · ‎05-11-2010

Once the messages are read from the syslog.log, they are stored in the RME database. Only those messages will be seen in the syslog reports.

After the messages have been inserted into the database, you can do whatever with the log file. The ability to run reports on older syslog messages depends on the purge policy you have setup for the syslog messages under RME > Admin > Syslog > Set Purge Policy.

readytolearncisco · ‎05-12-2010

This brings up another question...if the syslog messages within the syslog.log file is pulled into RME and is no longer seen from within syslog.log itself, does it even really matter what the size of the syslog.log file is?