Sylogd on HP-UX 11.0 - HP UX

This is a discussion on Sylogd on HP-UX 11.0 - HP UX ; Hello, my syslog deamon logs all local7-syslogs (from Cisco devices) to a seperate file, called ciscolog.log. A script should move that file every 10 sec. to another place. After moving, I think that the syslogd should create a new "ciscolog.log"-file, ...

+ Reply to Thread
Results 1 to 5 of 5

Thread: Sylogd on HP-UX 11.0

  1. Sylogd on HP-UX 11.0

    Hello,
    my syslog deamon logs all local7-syslogs (from Cisco devices) to a
    seperate file, called ciscolog.log. A script should move that file
    every 10 sec. to another place. After moving, I think that the syslogd
    should create a new "ciscolog.log"-file, if a new local7-syslogs comes
    in. But the deamon doesn't create a new file and all following
    local7-syslogs will be lost.
    I've tested my script on ubuntu-linux and it works properly, because
    the syslogd creates the new ciscolog.log.

    Does anybody know that problem? Should I install a new version of the
    syslogd?

    Regads,
    Christian


  2. Re: Sylogd on HP-UX 11.0

    In article <1138969136.040902.307740@o13g2000cwo.googlegroups. com>, Christian
    Roos wrote:
    > Hello,
    > my syslog deamon logs all local7-syslogs (from Cisco devices) to a
    > seperate file, called ciscolog.log. A script should move that file
    > every 10 sec. to another place. After moving, I think that the syslogd
    > should create a new "ciscolog.log"-file, if a new local7-syslogs comes
    > in. But the deamon doesn't create a new file and all following
    > local7-syslogs will be lost.
    > I've tested my script on ubuntu-linux and it works properly, because
    > the syslogd creates the new ciscolog.log.
    >
    > Does anybody know that problem? Should I install a new version of the
    > syslogd?


    That it works on Ubuntu surprises me. Typically syslogd keeps the file
    descriptor(s) open, so if you move the file, it will continue writing to where
    ever you moved the file.

    It works that way on HP-UX and on RedHat Linux.

    What you need to do is signal syslogd to re-initialize. From the HP-UX man page:

    To make syslogd, re-read its configuration file, send it a HANGUP
    signal:

    kill -HUP `cat /var/run/syslog.pid`

    ...
    ...

    syslogd configures itself when it starts up and whenever it receives a
    hangup signal. Lines in the configuration file consist of a selector
    to determine the message priorities to which the line applies and an
    action. The action field is separated from the selector by one or
    more tabs.


    And from the Redhat(FC1) manpage:

    SIGHUP This lets syslogd perform a re-initialization. All open files
    are closed, the configuration file (default is /etc/syslog.conf)
    will be reread and the syslog(3) facility is started again.


    However, I don't know how comfortable I would be with re-initializing syslogd
    every 10 seconds...

    Kevin
    --
    Unix Guy Consulting, LLC
    Unix and Linux Automation, Shell, Perl and CGI scripting
    http://www.unix-guy.com

  3. Re: Sylogd on HP-UX 11.0

    Kevin Collins wrote:

    >In article <1138969136.040902.307740@o13g2000cwo.googlegroups. com>, Christian
    >Roos wrote:
    >> Hello,
    >> my syslog deamon logs all local7-syslogs (from Cisco devices) to a
    >> seperate file, called ciscolog.log. A script should move that file
    >> every 10 sec. to another place. After moving, I think that the syslogd
    >> should create a new "ciscolog.log"-file, if a new local7-syslogs comes
    >> in. But the deamon doesn't create a new file and all following
    >> local7-syslogs will be lost.
    >> I've tested my script on ubuntu-linux and it works properly, because
    >> the syslogd creates the new ciscolog.log.
    >>
    >> Does anybody know that problem? Should I install a new version of the
    >> syslogd?

    >
    >That it works on Ubuntu surprises me. Typically syslogd keeps the file
    >descriptor(s) open, so if you move the file, it will continue writing to where
    >ever you moved the file.
    >
    >It works that way on HP-UX and on RedHat Linux.
    >
    >What you need to do is signal syslogd to re-initialize. From the HP-UX man page:
    >
    > To make syslogd, re-read its configuration file, send it a HANGUP
    > signal:
    >
    > kill -HUP `cat /var/run/syslog.pid`
    >
    > ...
    > ...
    >
    > syslogd configures itself when it starts up and whenever it receives a
    > hangup signal. Lines in the configuration file consist of a selector
    > to determine the message priorities to which the line applies and an
    > action. The action field is separated from the selector by one or
    > more tabs.
    >
    >
    >And from the Redhat(FC1) manpage:
    >
    > SIGHUP This lets syslogd perform a re-initialization. All open files
    > are closed, the configuration file (default is /etc/syslog.conf)
    > will be reread and the syslog(3) facility is started again.
    >
    >
    >However, I don't know how comfortable I would be with re-initializing syslogd
    >every 10 seconds...
    >
    >Kevin

    An alternative approach is that in stead of mv logfile oldlogfile (
    or whatever your file names are)

    Try cp logfile oldlogfile ; > logfile

    This copies the contents of the log to where you want it and the
    empties the original without closing it.

    syslogd will continue to write to the original file with out needing
    to be refreshed or restarted.

    Ted
    ================================================== ============
    | Ted Linnell |
    | |
    | Nunawading, Victoria , Australia |
    ================================================== ============

  4. Re: Sylogd on HP-UX 11.0

    > Try cp logfile oldlogfile ; > logfile

    Ok, this method works fine. Does anybody know, whether a log-message
    can be lost between copy and empty the logfile?

    Regards


  5. Re: Sylogd on HP-UX 11.0

    In article <1139149959.713878.33520@o13g2000cwo.googlegroups.c om>, Christian
    Roos wrote:
    >> Try cp logfile oldlogfile ; > logfile

    >
    > Ok, this method works fine. Does anybody know, whether a log-message
    > can be lost between copy and empty the logfile?


    Yes, it can and does - that's the reason you should do it only if you can
    accept the risk. And every 5-10 seconds, its almost guaranteed to happen.

    Kevin

    --
    Unix Guy Consulting, LLC
    Unix and Linux Automation, Shell, Perl and CGI scripting
    http://www.unix-guy.com

+ Reply to Thread