On Thu, 1 May 2008 07:25:55 -0500, McKown, John
<[EMAIL PROTECTED]> wrote:
>> -Original Message-
>> From: IBM Mainframe Discussion List
>> [mailto:[EMAIL PROTECTED] On Behalf Of Franco Oberto
>> Sent: Wednesday, April 30, 2008 10:23 PM
>> To: IBM-MAIN@BAMA.UA.EDU
>> Subject: ftp - syslogd - rotate
>>
>> HI ,
>>
>> We have Z/OS 1.7 .
>> If I want to break the output of syslogd
>> can I use the parameter rotate in the syslogd.conf or
>> other open source syslog-rotate programs
>>
>> Regards
>>
>> Franco Oberto
>
>I am not sure about 1.7. On z/OS 1.8, my /etc/syslog.conf file looks
>like:
>
>kern.* /var/log/kern.%Y-%m-%d
>user.* /var/log/user.%Y-%m-%d
>mail.* /var/log/mail.%Y-%m-%d
>news.* /var/log/news.%Y-%m-%d
>uucp.* /var/log/uucp.%Y-%m-%d
>daemon.* /var/log/daemon.%Y-%m-%d
>auth.* /var/log/auth.%Y-%m-%d
>cron.* /var/log/cron.%Y-%m-%d
>local0.* /var/log/local0.%Y-%m-%d
>local1.* /var/log/local1.%Y-%m-%d
>local2.* /var/log/local2.%Y-%m-%d
>local3.* /var/log/local3.%Y-%m-%d
>local4.* /var/log/local4.%Y-%m-%d
>local5.* /var/log/local5.%Y-%m-%d
>local6.* /var/log/local6.%Y-%m-%d
>local7.* /var/log/local7.%Y-%m-%d
>#*.crit @10.171.35.14.%Y-%m-%d
>#mark.* /var/log/mark.%Y-%m-%d
>
>I have a crontab running from ROOT which looks like:
>
>1 0 * * * kill -HUP $(cat /etc/syslog.pid)
>
>So that 1 second after midnight, the "kill" is issued. This causes
>syslogd to reread the /etc/syslog.conf and as a side effect pick up the
>new name. %Y is replaced with the 4 digit year, %m is replaced by the 2
>digit month, %d is replaced by the 2 digit day. You can then run some
>other process to clean up old files in /var/log
>
>--
I like that. Looks like it was done by a person who actually knows something
about *nix. :-) My setup is very simplistic. I have a crontab that executes a
cleanup script monthly on the 1st of the month at 18:00.
0 18 1 * * /etc/@cleanup_logs
It cleans up more than cron. Some directories (SAP, WAS, SMPNTS, /tmp)
have lots of logs / files (or "junk" in the case of /tmp) and I just delete by
age. For syslogd and cron I keep 3 months worth of logs. I never stop
cron, I just "zero" out the log as part of my script. But my syslogd setup was
done 9 or 10 years ago. I just looked at a current sample of syslog.conf and
it suggests something like you do.
It all works fine and I can count the number of times we actually need
to look at syslogd logs in a year on one hand, so keeping 3 months
is more than enough and we don't worry about any kind of archiving.
Here is the part of my script that takes care cleaning up the syslogd logs
and the cron logs:
#
# rename old syslogd files and zero out existing files
#
rm /tmp/syslogd/auth.log.old3
rm /tmp/syslogd/error.log.old3
rm /tmp/syslogd/garbagecan.log.old3
rm /tmp/syslogd/server.debug.old3
rm /tmp/syslogd/telnet.debug.old3
mv /tmp/syslogd/auth.log.old2/tmp/syslogd/auth.log.old3
mv /tmp/syslogd/error.log.old2 /tmp/syslogd/error.log.old3
mv /tmp/syslogd/garbagecan.log.old2 /tmp/syslogd/garbagecan.log.old3
mv /tmp/syslogd/server.debug.old2/tmp/syslogd/server.debug.old3
mv /tmp/syslogd/telnet.debug.old2/tmp/syslogd/telnet.debug.old3
mv /tmp/syslogd/auth.log.old1/tmp/syslogd/auth.log.old2
mv /tmp/syslogd/error.log.old1 /tmp/syslogd/error.log.old2
mv /tmp/syslogd/garbagecan.log.old1 /tmp/syslogd/garbagecan.log.old2
mv /tmp/syslogd/server.debug.old1/tmp/syslogd/server.debug.old2
mv /tmp/syslogd/telnet.debug.old1/tmp/syslogd/telnet.debug.old2
cp /tmp/syslogd/auth.log /tmp/syslogd/auth.log.old1
cp /tmp/syslogd/error.log/tmp/syslogd/error.log.old1
cp /tmp/syslogd/garbagecan.log /tmp/syslogd/garbagecan.log.old1
cp /tmp/syslogd/server.debug /tmp/syslogd/server.debug.old1
cp /tmp/syslogd/telnet.debug /tmp/syslogd/telnet.debug.old1
> /tmp/syslogd/auth.log
> /tmp/syslogd/error.log
> /tmp/syslogd/garbagecan.log