Problems with logadm / syslog in Sol 9/10

avronius · #1 (**permalink**) 10-29-2008

Hello folks,

I've been making some changes to logadm.conf, but I'm not getting quite the results that I'm expecting

Code:

/var/log/pool/poold -a 'pkill -HUP poold; true' -N -s 512k
/var/svc/log/*.log -C 8 -N -s 1m
/var/adm/messages -a 'pkill -HUP `cat /var/run/syslog.pid`' -C 8 -s 10m
/var/adm/pacct -a 'usr/lib/acct/accton pacct' -C 0 -g adm -m 664 -N -o adm -p never
/var/cron/log -c -s 512k -t /var/cron/olog
/var/fm/fmd/errlog -M '/usr/sbin/fmadm -q rotate errlog && mv /var/fm/fmd/errlog.0- $nfile' -N -s 2m
/var/fm/fmd/fltlog -A 6m '/usr/sbin/fmadm -q rotate fltlog && mv /var/fm/fmd/fltlog.0- $nfile' -N -s 10m
/var/log/syslog -a 'kill -HUP `cat /var/run/syslog.pid`' -C 8 -s 10m
/var/lp/logs/lpsched -C 8 -N -t '$file $N'
/var/adm/spellhist -N -s 512k -t /var/adm/spellhist.old
/var/adm/sulog -C 8 -N -s 512k
/var/adm/vold.log -N -s 256k -t /var/adm/vold.log.old
/var/adm/wtmpx -N -p never -s 5m -t /var/adm/wtmpx.old
/var/saf/_log -C 8 -N -s 256k
/var/saf/zsmon/log -C 8 -N -s 256k
/var/log/authlog -a 'kill -HUP `cat /var/run/syslog.pid`' -C 8 -N -s 256k
/var/log/kernlog -a 'kill -HUP `cat /var/run/syslog.pid`' -C 8 -N -s 512k
/var/log/userlog -a 'kill -HUP `cat /var/run/syslog.pid`' -C 8 -N -s 512k
/var/log/daemonlog -a 'kill -HUP `cat /var/run/syslog.pid`' -C 8 -N -s 512k
/var/adm/loginlog -a 'kill -HUP `cat /var/run/syslog.pid`' -C 8 -N -s 512k
/var/log/maillog -a 'kill -HUP `cat /var/run/syslog.pid`' -C 0 -N -s 512m

But, the logs aren't rotating based on size as expected (of specific concern are maillog, messages, authlog and wtmpx)

Yes, I do restart the daemon after each modification

I'm sure that I'm missing something simple, but I'm just not seeing it...

incredible · #2 (**permalink**) 10-30-2008

What do you want to achieve?

avronius · #3 (**permalink**) 10-30-2008

I'm hoping to see my logs rotate based on exceeding the size limitation. Failing this, I'll need to switch to date based rotation.

incredible · #4 (**permalink**) 10-31-2008

Have you actually made use of the syslog.conf file ?
#ident "@(#)syslog.conf 1.5 98/12/14 SMI" /* SunOS 5.0 */
#
# Copyright (c) 1991-1998 by Sun Microsystems, Inc.
# All rights reserved.
#
# syslog configuration file.
#
# This file is processed by m4 so be careful to quote (`') names
# that match m4 reserved words. Also, within ifdef's, arguments
# containing commas must be quoted.
#
*.err;kern.notice;auth.notice /dev/sysmsg
*.err;kern.debug;daemon.notice;mail.crit /var/adm/messages

*.alert;kern.err;daemon.err operator
*.alert root

*.emerg *

# if a non-loghost machine chooses to have authentication messages
# sent to the loghost machine, un-comment out the following line:
#auth.notice ifdef(`LOGHOST', /var/log/authlog, @loghost)

mail.debug ifdef(`LOGHOST', /var/log/syslog, @loghost)

#
# non-loghost machines will use the following lines to cause "user"
# log messages to be logged locally.
#
ifdef(`LOGHOST', ,
user.err /dev/sysmsg
user.err /var/adm/messages
user.alert `root, operator'
user.emerg *
)

avronius · #5 (**permalink**) 10-31-2008

syslog.conf:

Code:

#ident  "@(#)syslog.conf        1.5     98/12/14 SMI"   /* SunOS 5.0 */
#
# Copyright (c) 1991-1998 by Sun Microsystems, Inc.
# All rights reserved.
#
# syslog configuration file.
#
# This file is processed by m4 so be careful to quote (`') names
# that match m4 reserved words.  Also, within ifdef's, arguments
# containing commas must be quoted.
################################################################################

### Alerts to users:
*.emerg                                 *
*.alert;kern.notice                     root, operator
################################################################################

### Alerts to file only
auth.err                                /var/log/authlog
mail.info                               /var/log/maillog
*.notice                                /var/adm/messages
### ORACLE database servers (Fujitsu hardware):
*.debug;user.info;mark,syslog.debug     /opt/SMAW/SMAWlog3/syslogd_pipe
################################################################################

### Alerts to file and loghost
*.err;auth.notice;kern.debug            ifdef(`LOGHOST', /var/adm/messages, @loghost)
kern.info                               ifdef(`LOGHOST', /var/log/kernlog, @loghost)
user.info                               ifdef(`LOGHOST', /var/log/userlog, @loghost)
daemon.info                             ifdef(`LOGHOST', /var/log/daemonlog, @loghost)
auth.info                               ifdef(`LOGHOST', /var/log/authlog, @loghost)
cron.info                               ifdef(`LOGHOST', /var/log/cronlog, @loghost)
################################################################################

Some applications are writing to files directly...

seg · #6 (**permalink**) 10-31-2008

Run "logadm -vn" to get verbose output without changing any log files. That might help troubleshoot this.

avronius · #7 (**permalink**) 11-03-2008

Here are the results of logadm -vn:

Code:

bash-3.00# logadm -vn
# loading /etc/logadm.conf
# processing logname: /var/log/pool/poold
#     using default expire rule: -C10
#     using default template: $file.$n
# processing logname: /var/svc/log/*.log
#     using default template: $file.$n
# processing logname: /var/adm/messages
#     using default template: $file.$n
# processing logname: /var/adm/pacct
#     using default template: $file.$n
# processing logname: /var/cron/log
#     using default expire rule: -C10
# processing logname: /var/fm/fmd/errlog
#     using default expire rule: -C10
#     using default template: $file.$n
# processing logname: /var/fm/fmd/fltlog
#     using default template: $file.$n
# processing logname: /var/log/syslog
#     using default template: $file.$n
# processing logname: /var/lp/logs/lpsched
#     using default rotate rules: -s1b -p1w
# processing logname: /var/adm/spellhist
#     using default expire rule: -C10
# processing logname: /var/adm/sulog
#     using default template: $file.$n
# processing logname: /var/adm/vold.log
#     using default expire rule: -C10
# processing logname: /var/adm/wtmpx
#     using default expire rule: -C10
# processing logname: /var/saf/_log
#     using default template: $file.$n
# processing logname: /var/saf/zsmon/log
#     using default template: $file.$n
# processing logname: /var/log/authlog
#     using default template: $file.$n
# processing logname: /var/log/kernlog
#     using default template: $file.$n
# processing logname: /var/log/userlog
#     using default template: $file.$n
# processing logname: /var/log/daemonlog
#     using default template: $file.$n
# processing logname: /var/adm/loginlog
#     using default template: $file.$n
# processing logname: /var/log/maillog
#     using default template: $file.$n
# /etc/logadm.conf unchanged

More UNIX and Linux Forum Topics You Might Find Helpful
Thread	Thread Starter	Forum	Replies	Last Post
logadm	melanie_pfefer	SUN Solaris	3	12-27-2006 06:16 AM
logadm package	syscity	SUN Solaris	1	09-22-2006 10:51 AM
crontab logadm vs. logchecker in Solaris 10	dawinkler	SUN Solaris	1	12-01-2005 12:11 PM
syslog	greg0320	UNIX for Dummies Questions & Answers	4	06-11-2004 02:26 PM
Who knows syslog?	acqy	UNIX for Dummies Questions & Answers	3	01-06-2004 05:56 AM

Thread Tools	Search this Thread
Show Printable Version Email this Page	Search this Thread: Advanced Search
Display Modes	Rate This Thread
Switch to Linear Mode Hybrid Mode Switch to Threaded Mode	Rate This Thread: