08-14-2011 08:36 PM
Hi all. I just want to clarify the operation of RME v4.3.0 and CS 3.3.0.
Log rotation is configured for 10MB, and 5 number of backups within Common Services.
Backup policy is configured for 100MB within RME.
Purge policy is configured for every 50 days within RME.
My understanding that I seek clarity on is this;
1. As soon as any messages within syslog.log are 50 days old, they will be purged (removed). Is this understanding correct?
2. The purged (removed) messages will be backed up as per the backup policy - i.e. moved to a backup file. Is this understanding correct?
3. What happens when the backup hits the 100MB limit? Does it create a new version of the backup file?
4. Given the purge/backup policy, when would the log rotation actually be used? I assume that it would only be used 'if' the syslog.log file reached 10MB?
5. With log rotation set to 5 backups, what happens to the 6th backup? Would it overwrite the first backup (the oldest) that was created?
I really hope someone out there (i.e. Joesph Clarke) can clarify the above queries.
Thanks
Dazzler
Solved! Go to Solution.
08-17-2011 10:31 PM
HI Dazzler,
Answers to your questions inline
1. As soon as any messages within syslog.log are 50 days old, they will be purged (removed). Is this understanding correct?
Yes this is correct, syslog purge purges the old syslogs from RME for the configured days old
2. The purged (removed) messages will be backed up as per the backup policy - i.e. moved to a backup file. Is this understanding correct?
Backup policy is different to purge policy.Backup policy actually backsup syslogs (before purging) as 100MB flat files stored separately under CSCOpx/RME/files/syslog folder. These files never get purged, need to purge/move manually.
While purge policy on the other hand purges syslogs older than 50 days from syslog.log
Generally most users dont use backup policy, unless you need to keep all syslog data into a flat file, which you cannot use it to view reports etc in RME.
3. What happens when the backup hits the 100MB limit? Does it create a new version of the backup file?
Yes once there is 100MB flat file, it will create a new flat file for the next 100MB.
4. Given the purge/backup policy, when would the log rotation actually be used? I assume that it would only be used 'if' the syslog.log file reached 10MB?
Yes this is correct. Logrotation kicks in after the configured limit for syslog.log reaches (10MB in your setup)
5. With log rotation set to 5 backups, what happens to the 6th backup? Would it overwrite the first backup (the oldest) that was created?
Yes this is true also. the oldest file will be rotated with the new data.
Hope these answers your questions.
Regards
Pradeep
08-17-2011 10:31 PM
HI Dazzler,
Answers to your questions inline
1. As soon as any messages within syslog.log are 50 days old, they will be purged (removed). Is this understanding correct?
Yes this is correct, syslog purge purges the old syslogs from RME for the configured days old
2. The purged (removed) messages will be backed up as per the backup policy - i.e. moved to a backup file. Is this understanding correct?
Backup policy is different to purge policy.Backup policy actually backsup syslogs (before purging) as 100MB flat files stored separately under CSCOpx/RME/files/syslog folder. These files never get purged, need to purge/move manually.
While purge policy on the other hand purges syslogs older than 50 days from syslog.log
Generally most users dont use backup policy, unless you need to keep all syslog data into a flat file, which you cannot use it to view reports etc in RME.
3. What happens when the backup hits the 100MB limit? Does it create a new version of the backup file?
Yes once there is 100MB flat file, it will create a new flat file for the next 100MB.
4. Given the purge/backup policy, when would the log rotation actually be used? I assume that it would only be used 'if' the syslog.log file reached 10MB?
Yes this is correct. Logrotation kicks in after the configured limit for syslog.log reaches (10MB in your setup)
5. With log rotation set to 5 backups, what happens to the 6th backup? Would it overwrite the first backup (the oldest) that was created?
Yes this is true also. the oldest file will be rotated with the new data.
Hope these answers your questions.
Regards
Pradeep
08-18-2011 06:43 AM
just one comment to what Pradeep pointed out in detail.
2. The purged (removed) messages [...]
> only purged syslog messages gets written to the backup file. The backup is for to keep these messages instead of just get rid of them
perhaps this thread helps to understand the process as well.
https://supportforums.cisco.com/message/3209757#3209757
4. Given the purge/backup policy, when would the log rotation actually be used? [...]
> the logrot.pl utility starts periodically at the configured scheduled timeand look if the configured files have reached their max size. Only if that is the case they will get rotated.
For a monthly backup of the "flat" syslog.log file I usually schedule logrot to start on the 1st every month and have the max size set low (1024 KB) and the number of files to keep is 12. This condition is certainly met and so I get a monthly history for 1 year of the flat syslog file for documentation/backup purpose.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide