Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

Logrot Issues

Running LMS 3.2 - I have logrot configured to rotate the syslog.log file after 1GB, but it's not functioning. I have configured logrot via Common Services GUI & via the CLI script, but neither seem to work. Here is the contents of the logrot.conf file:

var backup_dir = c:\progra~2\cscopx\log

var delay =

C:\PROGRA~2\CSCOpx\log\syslog.log 20 1024000 gz

1 ACCEPTED SOLUTION

Accepted Solutions
Cisco Employee

Re: Logrot Issues

Logrot -v only enables verbose mode.  If it didn't work before my guess is that the file wasn't quite 1 GB yet.  It was just barely over 1 GB in this execution.  If you do see problems with logrot, running it with -v will show what logrot is doing at each step of the way.

6 REPLIES
Cisco Employee

Re: Logrot Issues

Port the output of:

C:\PROGRA~2\CSCOpx\bin\perl.exe C:\PROGRA~2\CSCOpx\bin\logrot.pl -v

New Member

Re: Logrot Issues

It looks like that did the trick. Does the 'v' option force enable logrot? Also, considering I have a 365 day purge setting, will RME be able to report on the logs within the rotated/compressed files or only on the actual syslog.log file?

Thanks Joe!

C:\PROGRA~2\CSCOpx\bin>perl.exe C:\PROGRA~2\CSCOpx\bin\logrot.pl -v

Tue May 11 03:41:30 2010: INFO: Read variable backup_dir --> c:\progra~2\cscopx\

log

Tue May 11 03:41:30 2010: INFO: Read variable delay -->

Tue May 11 03:41:30 2010: INFO: Logfile = C:\PROGRA~2\CSCOpx\log\syslog.log, Bac

kup File = c:\progra~2\cscopx\log\syslog.log

Tue May 11 03:41:30 2010: INFO: Archiving C:\PROGRA~2\CSCOpx\log\syslog.log (fil

e size = 1167511841, conf size = 1048576000)

Tue May 11 03:41:30 2010: INFO: Rolling logfile archive.

Tue May 11 03:41:30 2010: INFO: Archiving C:\PROGRA~2\CSCOpx\log\syslog.log to c

:\progra~2\cscopx\log\syslog.log.0.

        1 file(s) copied.

Tue May 11 03:41:32 2010: INFO: Compressing c:\progra~2\cscopx\log\syslog.log.0

using gzip -f

Tue May 11 03:42:25 2010: INFO: Rotating C:\PROGRA~2\CSCOpx\log\syslog.log.

Cisco Employee

Re: Logrot Issues

Logrot -v only enables verbose mode.  If it didn't work before my guess is that the file wasn't quite 1 GB yet.  It was just barely over 1 GB in this execution.  If you do see problems with logrot, running it with -v will show what logrot is doing at each step of the way.

New Member

Re: Logrot Issues

Understood. As far as RME being able to report on the arhived/compressed files, is this true, or can RME only report on the contents of the

currently uncompressed/active syslog.log file? I have a purge setting of 365 days, and would like to be able to access up to the full 365 worth of syslog on each device. Thanks Joe.

Cisco Employee

Re: Logrot Issues

Once the messages are read from the syslog.log, they are stored in the RME database.  Only those messages will be seen in the syslog reports.

After the messages have been inserted into the database, you can do whatever with the log file.  The ability to run reports on older syslog messages depends on the purge policy you have setup for the syslog messages under RME > Admin > Syslog > Set Purge Policy.

New Member

Re: Logrot Issues

This brings up another question...if the syslog messages within the syslog.log file is pulled into RME and is no longer seen from within syslog.log itself, does it even really matter what the size of the syslog.log file is?

245
Views
0
Helpful
6
Replies