Visit Our UNIX and Linux User Community


Solaris 10 massive SMF log file


 
Thread Tools Search this Thread
Operating Systems Solaris Solaris 10 massive SMF log file
# 1  
Old 08-20-2013
Solaris 10 massive SMF log file

I found that there was a SMF log file: /var/svc/log/milestone-multi-user-server:default.log.0 which occupied around 19G bytes.
Please help me how to purge this massive file.
Can I just use cat /dev/null > /var/svc/log/milesto..... to this file without any interruption to a non-stop system?
Please Help.
# 2  
Old 08-20-2013
I would keep the very end of the log and delete the rest:

Code:
 
tail -n-1000 /var/svc/log/milestone-multi-user-server:default.log.0 > /var/svc/log/milestone-multi-user-server:default.log.0

This User Gave Thanks to hicksd8 For This Post:
# 3  
Old 08-20-2013
That would truncate the logfile to length zero, because the redirection is handled by the shell before the tail command can do it's work.

As for the original question. You can truncate the logfile, as long it is not open. You can check with

Code:
# /usr/sbin/fuser /var/svc/log/milestone-multi-user-server:default.log
/var/svc/log/milestone-multi-user-server:default.log:

If there is a process number after the colon, the file is open, like here:

Code:
/var/svc/log/system-filesystem-autofs:default.log:      965o     964o

These 2 Users Gave Thanks to hergp For This Post:
# 4  
Old 08-20-2013
Thanks all.
In this case , how can I truncate the log file if it is open?
# 5  
Old 08-20-2013
You already know how:
Code:
cat /dev/null > /path/to/logfile

This will zero the file without interrupting any processes that had it open.
This User Gave Thanks to bartus11 For This Post:
# 6  
Old 08-20-2013
Quote:
Originally Posted by bartus11
You already know how:
Code:
cat /dev/null > /path/to/logfile

This will zero the file without interrupting any processes that had it open.
That's not guaranteed to work.

Depending on how the file was opened, how it's written to, and the specifics of how the underlying file system handles attempts to write past the end of a file, you could wind up doing nothing more than creating a file every bit as large as it was, only whatever data that was in the file is lost.

Here's what happens:

1. A process has an open file descriptor on a file, and the file was not opened in "append" mode.
2. File is truncated to zero bytes by an outside process.
Note that file descriptors have a "current" offset associated with them, and operations outside the process do not effect that position.
3. The process writes to the file, and the bytes go to the original pre-truncation "current" offset in the file.
4. If the underlying file system does not support sparse files, it's back to being 19GB. If the file system does support sparse files, an "ls -l" will still show the file as being 19 GB, but a "du" will show that the file actually uses much less space.

And all bets are off if a process has a file memory-mapped and the file is truncated out from under the mapping. Just try truncating a binary executable when a copy of that binary is running....
This User Gave Thanks to achenle For This Post:
# 7  
Old 08-21-2013
For this issue, can logadm command to saftey truncate "milestone-multi-user-server:default.log.0" or setup a command line inside logadm.conf and let O/S to automatic truncate, keep rotate the file in 3 and limit the file size to 10M.
Thanks!

Previous Thread | Next Thread
Test Your Knowledge in Computers #419
Difficulty: Easy
Few popular modern Web browsers support JavaScript with built-in interpreters.
True or False?

7 More Discussions You Might Find Interesting

1. Shell Programming and Scripting

Massive ftp

friends good morning FTP works perfect but I have a doubt if I want to transport 10 files, I imagine that I should not open 10 connections as I can transfer more than 1 file? ftp -n <<!EOF open caburga user ephfact ephfact cd /users/efactura/docONE/entrada bin mput EPH`date... (16 Replies)
Discussion started by: tricampeon81
16 Replies

2. Solaris

SMF in Solaris wont write to stderr/stdout ?

Hi, I got a process (c written) that we usually run this way : EmsChkQu >> /EMS/log/EmsChkQu.log 2>&1 When trying to use it as a service I defined it this way : <?xml version='1.0'?> <!DOCTYPE service_bundle SYSTEM '/usr/share/lib/xml/dtd/service_bundle.dtd.1'> <service_bundle... (6 Replies)
Discussion started by: zionassedo
6 Replies

3. Solaris

How to change default log location of SMF registered processes.

Hi All, I am trying to change default log location ( var/logs/svc/<component>) of each and evry SMF registered processes and append to particular file (/opt/smf.log) . Please help ................. Thanks in advance !!! Gyan prakash (5 Replies)
Discussion started by: gyan_198
5 Replies

4. Solaris

Can solaris 10 SMF use remote dependencies

I have a customer who wants us to set up their applications to start using the solaris 10 SMF. One of their applications requires that 3 database instances are up and running, but those instances are on 3 separate servers. I can't think of any way that this can be done from what I have read on my... (1 Reply)
Discussion started by: rkruck
1 Replies

5. Solaris

SMF in Solaris 10

In SOlaris 9 for eg, inside the /etc/init.d/inetsvc file, you can set the tcp tracing by going to the last line and adding the following as :- inetd -s -t & In Solaris 10, I know we can use the svccfg to do it or with the inetadm command. When I use inetadm -m command to set the tcp tracing... (3 Replies)
Discussion started by: incredible
3 Replies

6. Solaris

Permission denied in SMF service log

I can't get the exact error message because I am at home, but on Solaris 10u5 machine I have at work, a few services are stuck in the maintenance state with the following error message in the individual service logs (/var/svc/log/FMRI:instance.log): Cannot chdir: permission denied Fortunately... (2 Replies)
Discussion started by: ilikecows
2 Replies

7. Solaris

Boot problem with SMF svcs-Solaris 10 for x86

Hi All, I am newbie in solaris, please guide me. A week before i installed solaris10 on my x86 system, it was working fine i always used "init 5" to shutdown my system as per my collegue advice. But yesterday when i started my system it gave me following message ... (6 Replies)
Discussion started by: imrankhan.in
6 Replies

Featured Tech Videos