Log file too large

[Rafael Mendes]

Hello iveryone,

I have a problem, some log files on my cisco works is too large.

Folder C:\Program Files\CSCOpx\databases\rmeng

SyslogThird 17GB

SyslogSecond 18GB

SyslogFirst 2GB

How i can reduce this logs? Can delete?

My partition C:\ is full.

Tks,

Rafael

[Martin Ermel]

which LMS version are you using?

[Rafael Mendes]

4.0

[Marvin Rhoads]

You should look at your logrot (log rotation) settings. See this information in the admin guide.

Also, one can configure the syslog process to purge old messages. See here for the LMS 4.1 procedure.

Hope this helps.

[Martin Ermel]

as mklemovitch pointed out, you should first try and find what is causing your syslog file to grow and if you can prevent this.

Only purging the current records does not free up the diskspace; for this you have to drop and recreate the dataspaces. All current syslogs in LMS will be lost but you will still have them in the flat syslog file.

you need a special class file the is shipped with your LMS version and located in this path:

    NMSROOT\MDC\tomcat\webapps\rme\WEB-INF\classes\com\cisco\nm\rmeng\debugTools\syslog\DBSpaceReclaimer.class

to use this tool, stop and start RMEDbEngine with

    pdterm RMEDbEngine

when finished restart it with

    pdexec RMEDbEngine

then issue the following command:

NMSROOT\lib\jre\bin\java -classpath NMSROOT\databases\rmeng\debugTools\syslog;NMSROOT\lib\classpath;NMSROOT\www\classpath;NMSROOT\MDC\tomcat\webapps\rme\WEB-INF\classes\;NMSROOT\MDC\tomcat\webapps\rme\WEB-INF\lib\log4j.jar com.cisco.nm.rmeng.debugTools.syslog.DBSpaceReclaimer

with NMSROOT being your LMS installation path. Use the short notation, i.e. "C:\Program Files" would be "C:\Progra~1\CSCOpx". In a DOS box issue the command

    echo %SM_HOME%

to see what it is on your system.

after this is done stop and restart dmgtd with

    net stop crmdmgtd

start it with

    net start crmdmgtd

wait around 20 min to login again

[Rafael Mendes]

Hello Martin,

I try to apply this commands, but, receive this error on cmd:

C:\Program Files\CSCOpx\lib\jre\bin>java -classpath C:\ProgramFiles\CSCOpx\datab

ases\rmeng\debugTools\syslog;C:\ProgramFiles\CSCOpx\lib\classpath;C:\ProgramFile

s\CSCOpx\www\classpath;C:\ProgramFiles\CSCOpx\MDC\tomcat\webapps\rme\WEBINF\clas

ses\;C:\ProgramFiles\CSCOpx\MDC\tomcat\webapps\rme\WEB-INF\lib\log4j.jar com.cis

co.nm.rmeng.debugTools.syslog.DBSpaceReclaimer

Exception in thread "main" java.lang.NoClassDefFoundError: com/cisco/nm/rmeng/de

bugTools/syslog/DBSpaceReclaimer

Caused by: java.lang.ClassNotFoundException: com.cisco.nm.rmeng.debugTools.syslo

g.DBSpaceReclaimer

        at java.net.URLClassLoader$1.run(URLClassLoader.java:202)

        at java.security.AccessController.doPrivileged(Native Method)

        at java.net.URLClassLoader.findClass(URLClassLoader.java:190)

        at java.lang.ClassLoader.loadClass(ClassLoader.java:307)

        at sun.misc.Launcher$AppClassLoader.loadClass(Launcher.java:301)

        at java.lang.ClassLoader.loadClass(ClassLoader.java:248)

Could not find the main class: com.cisco.nm.rmeng.debugTools.syslog.DBSpaceRecla

imer.  Program will exit.

I configure the logrot utility for rotate SyslogThird file, but, i not see any results for this configuration.

C:\Program  Files\CSCOpx\databases\rmeng\SyslogThird.db

4194304

gz

0

[Martin Ermel]

you did not specify NMSROOT correctly. Your installation path is C:\Program Files\CSCOpx which contains a space that you just ignored by typing C:\ProgramFiles\CSCOpx - this is not possible. As I said, use the short notation which is C:\Progra~1\CSCOpx.

NEVER rotate a database file with logrot.pl. logrot.pl is a tool to rotate LOG files. You should be happy if logrot has not touched this file yet! SyslogFirst.db, SyslogSecond.db, SyslogThird.db are dataspaces which cannot be rotated without messing up the RME database. logrot.pl can be used to rotate the plain syslog file NMSROOT\log\syslog.log but not dataspaces or databases.

[Rafael Mendes]

Ok, i changed and he show the message below:

C:\Program Files\CSCOpx\lib\jre\bin>java -classpath C:\Progra~1\CSCOpx\databases

\rmeng\debugTools\syslog;C:\Progra~1\CSCOpx\lib\classpath;C:\Progra~1\CSCOpx\www

\classpath;C:\Progra~1\CSCOpx\MDC\tomcat\webapps\rme\WEB-INF\classes\;C:\Progra~

1\CSCOpx\MDC\tomcat\webapps\rme\WEB-INF\lib\log4j.jar com.cisco.nm.rmeng.debugTo

ols.syslog.DBSpaceReclaimer

RMEDbEngine needs to be restarted before this tool is run.

drooping dbspace

Dropped false

SyslogFirst.db cannot be deleted.

drooping dbspace

Dropped false

SyslogThird.db cannot be deleted.

drooping dbspace

Dropped false

SyslogSecond.db cannot be deleted.

As one or more application will be down , it is recommended to restart the daem

on manager now.

The correct to have deleted the files?Do we have any permission issue?

Tks

[Martin Ermel]

the reason for this is possibly due to the fact that a process tries to access any of the tables which could be a simple job, or due to the fact that you hold syslog messages for a very long time in LMS (I typically use not more then 31 days)

what are your settings for keeping syslog messages in LMS ?

    Admin > Network > Purge Settings > Syslog Purge Settings

now, manually purge records older than 7 days:

    Admin > Network > Purge Settings > Syslog Force Purge

also, as I satated in my first post, have you stopped and started the RME database before issuing this command ?

If not, control the status of this processes with

    pdshow RMEDbEngine

if RMEDbEngine is stopped, try to restart it with

    pdexec RMEDbEngine

if it is running stop and restart it

if this fails, restart LMS with

    net stop crmdmgtd

    net start crmdmgtd

wait up to 30 min until all LMS processes are up und running, then retry it with the following steps:

    pdterm RMEDbEngine

    pdexec RMEDbEngine

use this long command to execute DBSpaceReclaimer

[Rafael Mendes]

Martin,

I set my syslog for 7 days.

Yes, i had stopped and started RME jog before issuing the command.

After apply this commands, apache do not works anymore...shows the output:

HTTP Status 500 -

ype Exception report

message

description The server encountered an internal error () that  prevented it from fulfilling this request.

exception

java.lang.NullPointerException
     com.cisco.nm.cmf.util.AjaxAccessFilter.doFilter(AjaxAccessFilter.java:153)
     com.cisco.nm.cmf.util.AccessLogFilter.doFilter(AccessLogFilter.java:128)

note The full stack trace of the root cause is available in the  Apache Tomcat/5.5.29 logs.

Wintel team increase the vmware, now, we have 10GB free, but apache not works.

[Martin Ermel]

after using DBSpaceReclaimer, have you restarted dmgtd again with the following commands ?

    net stop crmdmgtd

    net start crmdmgtd

If not, do this and after 30 min try to access LMS again. If you still have problems, issue the following commands and upload the file C:\Windows\temp\pdshow.out to the thread:

    pdshow -brief > C:\Windows\temp\pdshow.out

    pdshow >> C:\Windows\temp\pdshow.out

[Rafael Mendes]

I upgrade version 4.0 for version 4.1, and its working fine .

[Martin Ermel · Accepted solution]

good decission! :-)

but keep an eye on your log files, i.e. configure log rotation and - at the beginning - control the size of the syslog db files regulary. If they are still growing fast you should try to find out what causes this issue.

[Rafael Mendes]

Sure!

Tks for help.

[srego4]

other than some technical reasons why it is so big, you could try this

If you have way too many devices sending syslogs, create some message filters to drop certain type of log messages, eg. link up/down. You could even create a filter to keep critical device's linkup/down messages if you want, but drop all others.

or, periodically (weekly/monthly?) stop your syslog process and cut the syslog.log file from the log folder and store it elsewhere. when you start the process syslog and the daemon mgr again, a new syslog file will be created.