06-08-2011 08:11 AM
logrot.pl does not check diskspace before doing a copy process of syslog_info; if there is not enough space, the copy process fails and the content of syslog_log is lost;
I know, that the error handling of such a script cannot take respect on each and every possible error that could appear but in case of the syslog file I would say it is such an essential file that it would be great that the loss of the content could be avoided.
currently I am unable to test if this issue is present in the current version but I found it to be valid in LMS 3.2 on solaris 9; here is the confiuration of logrot.pl
/var/log is configured as the backup directory,
/var/log/syslog_info is configured to be backed up
it seems when starting logrot.pl it first tries to copy syslog_info
the copy process fails due to /var being 100% in use
bash-2.05# /opt/CSCOpx/bin/logrot.pl -c
Read config successfully.
Logrot Configuration Menu
-------------------------
1. Edit variables
2. Edit log files
3. Quit and save changes
4. Quit without saving changes
Enter option: 1
Number Variable Name [Variable Value]
---------------------------------------------------------
1. Backup Directory [/var/log]
2. Restart Delay [60]
q. Go back
Enter variable number to change: q
Logrot Configuration Menu
-------------------------
1. Edit variables
2. Edit log files
3. Quit and save changes
4. Quit without saving changes
Enter option: 2
Number Logfile Name Number of Archives Max Size Compress
-----------------------------------------------------------------------------
1. /var/log/syslog_info 13 1024 gz
a. Add logfile(s)
d. Delete logfile(s)
q. Go back
Enter option or logfile number to edit: q
Logrot Configuration Menu
-------------------------
1. Edit variables
2. Edit log files
3. Quit and save changes
4. Quit without saving changes
Enter option: 4
bash-2.05#
===============================================================
===============================================================
bash-2.05# /opt/CSCOpx/bin/perl /opt/CSCOpx/bin/logrot.pl
cp: /var/log/syslog_info.12.gz: No space left on device
cp: /var/log/syslog_info.0: No space left on device
Wed Jun 8 16:44:03 2011: WARNING: Unable to archive /var/log/syslog_info: No such file or directory
gzip: /var/log/syslog_info.0: No such file or directory
Wed Jun 8 16:44:03 2011: WARNING: Unable to compress /var/log/syslog_info.0: 256
bash-2.05#
bash-2.05# cd /var/log/
bash-2.05# ls -al
total 769616
drwxr-xr-x 2 root sys 1536 Jun 8 16:44 .
drwxr-xr-x 38 root root 1024 Sep 24 2010 ..
-rw------- 1 root sys 0 Jul 27 2005 authlog
-rw-r--r-- 1 root other 372880 Jun 8 02:00 cmMapShare.log
-rw-r--r-- 1 root other 838 Mar 22 2006 sysidconfig.log
-rw-r--r-- 1 root other 884 Jun 8 04:00 syslog
-rw-r--r-- 1 root other 17392 Jun 7 01:00 syslog.0
-rw-r--r-- 1 root other 17299 Jun 1 01:00 syslog.1
-rw-r--r-- 1 root other 16107 May 25 01:00 syslog.2
-rw-r--r-- 1 root other 15908 May 18 01:00 syslog.3
-rw-r--r-- 1 root other 16249 May 11 01:00 syslog.4
-rw-r--r-- 1 root other 17047 May 4 01:00 syslog.5
-rw-r--r-- 1 root other 15908 Apr 27 01:00 syslog.6
-rw-r--r-- 1 root other 15912 Apr 20 01:00 syslog.7
-rw-rw-r-- 1 root sys 0 Jun 8 16:44 syslog_info
-rw-rw-r-- 1 root sys 16485733 Sep 1 2010 syslog_info.0.gz
-rw-rw-r-- 1 root sys 16485733 Sep 1 2010 syslog_info.1.gz
-rw-rw-r-- 1 root sys 19319177 Dec 1 2009 syslog_info.10.gz
-rw-rw-r-- 1 root sys 87397723 Nov 3 2009 syslog_info.11.gz
-rw-rw-r-- 1 root sys 84321257 Oct 5 2007 syslog_info.2.Z.old
-rw-rw-r-- 1 root sys 20818106 Aug 1 2010 syslog_info.2.gz
-rw-rw-r-- 1 root sys 23242884 Jul 1 2010 syslog_info.3.gz
-rw-rw-r-- 1 root sys 19556306 Jun 1 2010 syslog_info.4.gz
-rw-rw-r-- 1 root sys 18299543 May 1 2010 syslog_info.5.gz
-rw-rw-r-- 1 root sys 21785629 Apr 1 2010 syslog_info.6.gz
-rw-rw-r-- 1 root sys 21120869 Mar 1 2010 syslog_info.7.gz
-rw-rw-r-- 1 root sys 23420015 Feb 1 2010 syslog_info.8.gz
-rw-rw-r-- 1 root sys 20852151 Jan 1 2010 syslog_info.9.gz
bash-2.05
before this action syslog_info was about 3 Gig
06-09-2011 12:51 AM
Would it be sufficient to change the warning about archival to an error to make it fatal?
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: