On Thu, 1 May 2008 07:25:55 -0500, McKown, John
[EMAIL PROTECTED] wrote:
-Original Message-
From: IBM Mainframe Discussion List
[mailto:[EMAIL PROTECTED] On Behalf Of Franco Oberto
Sent: Wednesday, April 30, 2008 10:23 PM
To: IBM-MAIN@BAMA.UA.EDU
Subject: ftp - syslogd - rotate
HI ,
We have Z/OS 1.7 .
If I want to break the output of syslogd
can I use the parameter rotate in the syslogd.conf or
other open source syslog-rotate programs
Regards
Franco Oberto
I am not sure about 1.7. On z/OS 1.8, my /etc/syslog.conf file looks
like:
kern.* /var/log/kern.%Y-%m-%d
user.* /var/log/user.%Y-%m-%d
mail.* /var/log/mail.%Y-%m-%d
news.* /var/log/news.%Y-%m-%d
uucp.* /var/log/uucp.%Y-%m-%d
daemon.* /var/log/daemon.%Y-%m-%d
auth.* /var/log/auth.%Y-%m-%d
cron.* /var/log/cron.%Y-%m-%d
local0.* /var/log/local0.%Y-%m-%d
local1.* /var/log/local1.%Y-%m-%d
local2.* /var/log/local2.%Y-%m-%d
local3.* /var/log/local3.%Y-%m-%d
local4.* /var/log/local4.%Y-%m-%d
local5.* /var/log/local5.%Y-%m-%d
local6.* /var/log/local6.%Y-%m-%d
local7.* /var/log/local7.%Y-%m-%d
#*.crit @10.171.35.14.%Y-%m-%d
#mark.* /var/log/mark.%Y-%m-%d
I have a crontab running from ROOT which looks like:
1 0 * * * kill -HUP $(cat /etc/syslog.pid)
So that 1 second after midnight, the kill is issued. This causes
syslogd to reread the /etc/syslog.conf and as a side effect pick up the
new name. %Y is replaced with the 4 digit year, %m is replaced by the 2
digit month, %d is replaced by the 2 digit day. You can then run some
other process to clean up old files in /var/log
--
I like that. Looks like it was done by a person who actually knows something
about *nix. :-) My setup is very simplistic. I have a crontab that executes a
cleanup script monthly on the 1st of the month at 18:00.
0 18 1 * * /etc/@cleanup_logs
It cleans up more than cron. Some directories (SAP, WAS, SMPNTS, /tmp)
have lots of logs / files (or junk in the case of /tmp) and I just delete by
age. For syslogd and cron I keep 3 months worth of logs. I never stop
cron, I just zero out the log as part of my script. But my syslogd setup was
done 9 or 10 years ago. I just looked at a current sample of syslog.conf and
it suggests something like you do.
It all works fine and I can count the number of times we actually need
to look at syslogd logs in a year on one hand, so keeping 3 months
is more than enough and we don't worry about any kind of archiving.
Here is the part of my script that takes care cleaning up the syslogd logs
and the cron logs:
#
# rename old syslogd files and zero out existing files
#
rm /tmp/syslogd/auth.log.old3
rm /tmp/syslogd/error.log.old3
rm /tmp/syslogd/garbagecan.log.old3
rm /tmp/syslogd/server.debug.old3
rm /tmp/syslogd/telnet.debug.old3
mv /tmp/syslogd/auth.log.old2/tmp/syslogd/auth.log.old3
mv /tmp/syslogd/error.log.old2 /tmp/syslogd/error.log.old3
mv /tmp/syslogd/garbagecan.log.old2 /tmp/syslogd/garbagecan.log.old3
mv /tmp/syslogd/server.debug.old2/tmp/syslogd/server.debug.old3
mv /tmp/syslogd/telnet.debug.old2/tmp/syslogd/telnet.debug.old3
mv /tmp/syslogd/auth.log.old1/tmp/syslogd/auth.log.old2
mv /tmp/syslogd/error.log.old1 /tmp/syslogd/error.log.old2
mv /tmp/syslogd/garbagecan.log.old1 /tmp/syslogd/garbagecan.log.old2
mv /tmp/syslogd/server.debug.old1/tmp/syslogd/server.debug.old2
mv /tmp/syslogd/telnet.debug.old1/tmp/syslogd/telnet.debug.old2
cp /tmp/syslogd/auth.log /tmp/syslogd/auth.log.old1
cp /tmp/syslogd/error.log/tmp/syslogd/error.log.old1
cp /tmp/syslogd/garbagecan.log /tmp/syslogd/garbagecan.log.old1
cp /tmp/syslogd/server.debug /tmp/syslogd/server.debug.old1
cp /tmp/syslogd/telnet.debug /tmp/syslogd/telnet.debug.old1
/tmp/syslogd/auth.log
/tmp/syslogd/error.log
/tmp/syslogd/garbagecan.log
/tmp/syslogd/server.debug
/tmp/syslogd/telnet.debug
#
# rename old cron log file and zero out existing file
