Solaris 10 massive SMF log file | Unix Linux Forums | Solaris

  Go Back    


Solaris The Solaris Operating System, usually known simply as Solaris, is a Unix-based operating system introduced by Sun Microsystems. The Solaris OS is now owned by Oracle.

Solaris 10 massive SMF log file

Solaris


Closed Thread    
 
Thread Tools Search this Thread Display Modes
    #1  
Old 08-20-2013
AlexLi AlexLi is offline
Registered User
 
Join Date: Aug 2013
Last Activity: 21 August 2013, 9:07 PM EDT
Posts: 3
Thanks: 8
Thanked 0 Times in 0 Posts
Solaris 10 massive SMF log file

I found that there was a SMF log file: /var/svc/log/milestone-multi-user-server:default.log.0 which occupied around 19G bytes.
Please help me how to purge this massive file.
Can I just use cat /dev/null > /var/svc/log/milesto..... to this file without any interruption to a non-stop system?
Please Help.
Sponsored Links
    #2  
Old 08-20-2013
hicksd8 hicksd8 is offline Forum Advisor  
Registered User
 
Join Date: Feb 2012
Last Activity: 21 October 2014, 4:41 PM EDT
Location: Cornwall, UK
Posts: 832
Thanks: 44
Thanked 157 Times in 142 Posts
I would keep the very end of the log and delete the rest:


Code:
 
tail -n-1000 /var/svc/log/milestone-multi-user-server:default.log.0 > /var/svc/log/milestone-multi-user-server:default.log.0

The Following User Says Thank You to hicksd8 For This Useful Post:
AlexLi (08-20-2013)
Sponsored Links
    #3  
Old 08-20-2013
hergp hergp is offline Forum Advisor  
Problem Eliminator
 
Join Date: Jan 2010
Last Activity: 19 October 2014, 3:31 PM EDT
Location: Vienna, Austria
Posts: 802
Thanks: 18
Thanked 168 Times in 150 Posts
That would truncate the logfile to length zero, because the redirection is handled by the shell before the tail command can do it's work.

As for the original question. You can truncate the logfile, as long it is not open. You can check with


Code:
# /usr/sbin/fuser /var/svc/log/milestone-multi-user-server:default.log
/var/svc/log/milestone-multi-user-server:default.log:

If there is a process number after the colon, the file is open, like here:


Code:
/var/svc/log/system-filesystem-autofs:default.log:      965o     964o

The Following 2 Users Say Thank You to hergp For This Useful Post:
AlexLi (08-20-2013), jim mcnamara (08-20-2013)
    #4  
Old 08-20-2013
AlexLi AlexLi is offline
Registered User
 
Join Date: Aug 2013
Last Activity: 21 August 2013, 9:07 PM EDT
Posts: 3
Thanks: 8
Thanked 0 Times in 0 Posts
Thanks all.
In this case , how can I truncate the log file if it is open?
Sponsored Links
    #5  
Old 08-20-2013
bartus11's Avatar
bartus11 bartus11 is offline Forum Staff  
Moderator
 
Join Date: Apr 2009
Last Activity: 21 October 2014, 2:41 PM EDT
Posts: 3,710
Thanks: 7
Thanked 1,142 Times in 1,113 Posts
You already know how:
Code:
cat /dev/null > /path/to/logfile

This will zero the file without interrupting any processes that had it open.
The Following User Says Thank You to bartus11 For This Useful Post:
AlexLi (08-20-2013)
Sponsored Links
    #6  
Old 08-20-2013
achenle achenle is offline
Registered User
 
Join Date: Jun 2009
Last Activity: 21 October 2014, 4:34 PM EDT
Posts: 716
Thanks: 1
Thanked 102 Times in 98 Posts
Quote:
Originally Posted by bartus11 View Post
You already know how:
Code:
cat /dev/null > /path/to/logfile

This will zero the file without interrupting any processes that had it open.
That's not guaranteed to work.

Depending on how the file was opened, how it's written to, and the specifics of how the underlying file system handles attempts to write past the end of a file, you could wind up doing nothing more than creating a file every bit as large as it was, only whatever data that was in the file is lost.

Here's what happens:

1. A process has an open file descriptor on a file, and the file was not opened in "append" mode.
2. File is truncated to zero bytes by an outside process.
Note that file descriptors have a "current" offset associated with them, and operations outside the process do not effect that position.
3. The process writes to the file, and the bytes go to the original pre-truncation "current" offset in the file.
4. If the underlying file system does not support sparse files, it's back to being 19GB. If the file system does support sparse files, an "ls -l" will still show the file as being 19 GB, but a "du" will show that the file actually uses much less space.

And all bets are off if a process has a file memory-mapped and the file is truncated out from under the mapping. Just try truncating a binary executable when a copy of that binary is running....
The Following User Says Thank You to achenle For This Useful Post:
AlexLi (08-20-2013)
Sponsored Links
    #7  
Old 08-20-2013
AlexLi AlexLi is offline
Registered User
 
Join Date: Aug 2013
Last Activity: 21 August 2013, 9:07 PM EDT
Posts: 3
Thanks: 8
Thanked 0 Times in 0 Posts
For this issue, can logadm command to saftey truncate "milestone-multi-user-server:default.log.0" or setup a command line inside logadm.conf and let O/S to automatic truncate, keep rotate the file in 3 and limit the file size to 10M.
Thanks!
Sponsored Links
Closed Thread

Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes

More UNIX and Linux Forum Topics You Might Find Helpful
Thread Thread Starter Forum Replies Last Post
Can solaris 10 SMF use remote dependencies rkruck Solaris 1 09-10-2010 04:15 PM
SMF in Solaris 10 incredible Solaris 3 03-09-2010 02:30 AM
Permission denied in SMF service log ilikecows Solaris 2 09-12-2009 12:06 AM



All times are GMT -4. The time now is 05:34 PM.