Syslog rotation and purge/backup policy.

[dazza_johnson]

Hi all. I just want to clarify the operation of RME v4.3.0 and CS 3.3.0.

Log rotation is configured for 10MB, and 5 number of backups within Common Services.

Backup policy is configured for 100MB within RME.

Purge policy is configured for every 50 days within RME.

My understanding that I seek clarity on is this;

1. As soon as any messages within syslog.log are 50 days old, they will be purged (removed). Is this understanding correct?

2. The purged (removed) messages will be backed up as per the backup policy - i.e. moved to a backup file. Is this understanding correct?

3. What happens when the backup hits the 100MB limit? Does it create a new version of the backup file?

4. Given the purge/backup policy, when would the log rotation actually be used? I assume that it would only be used 'if' the syslog.log file reached 10MB?

5. With log rotation set to 5 backups, what happens to the 6th backup? Would it overwrite the first backup (the oldest) that was created?

I really hope someone out there (i.e. Joesph Clarke) can clarify the above queries.

Thanks

Dazzler

[Pradeep Vaka · Accepted solution]

HI Dazzler,

Answers to your questions inline

1. As soon as any messages within syslog.log are 50 days old, they will be purged (removed). Is this understanding correct?

Yes this is correct, syslog purge purges the old syslogs from RME for the configured days old

2.  The purged (removed) messages will be backed up as per the backup  policy - i.e. moved to a backup file. Is this understanding correct?

Backup policy is different to purge policy.Backup policy actually backsup syslogs (before purging) as 100MB flat files  stored separately under CSCOpx/RME/files/syslog folder. These files never get purged, need to purge/move manually.

While purge policy on the other hand purges syslogs older than 50 days from syslog.log

Generally most users dont use backup policy, unless you need to keep all syslog data into a flat file, which you cannot use it to view reports etc in RME.

3. What happens when the backup hits the 100MB limit? Does it create a new version of the backup file?

Yes once there is 100MB flat file, it will create a new flat file for the next 100MB.

4.  Given the purge/backup policy, when would the log rotation actually be  used? I assume that it would only be used 'if' the syslog.log file  reached 10MB?

Yes this is correct. Logrotation kicks in after the configured limit for syslog.log reaches (10MB in your setup)

5. With log rotation set to 5 backups, what happens  to the 6th backup? Would it overwrite the first backup (the oldest) that  was created?

Yes this is true also. the oldest file will be rotated with the new data.

Hope these answers your questions.

Regards

Pradeep

[Martin Ermel]

just one comment to what Pradeep pointed out in detail.

2.  The purged (removed) messages [...]

> only purged syslog messages gets written to the backup file. The backup is for to keep these messages instead of just get rid of them

perhaps this thread helps to understand the process as well.

https://supportforums.cisco.com/message/3209757#3209757

4.  Given the purge/backup policy, when would the log rotation actually be  used? [...]

> the logrot.pl utility starts periodically at the configured scheduled timeand look if the configured files have reached their max size. Only if that is the case they will get rotated.

For a monthly backup of the "flat" syslog.log file I usually schedule logrot to start on the 1st every month and have the max size set low (1024 KB) and the number of files to keep is 12. This condition is certainly met and so I get a monthly history for 1 year of the flat syslog file for documentation/backup purpose.