Sunday, 21 February 2010

Solaris logadm : Grouping logfiles

Using Solaris' "logadm" official tool for log rotation we can configure a rotation period of say daily or weekly and configure how many old logs are retained and where we retain these logs.  Its basically solaris' equivalent of linux's logrotate

Its easy enough to config but I couldn't find info on how to group logfiles together so though I'd blog my findings...

HOW TO GROUP LOGFILES IN LOGADM

Scenario I had is where a couple of instances of Oracle DB running on a server and I wanted the log files to be grouped together by logadm so that after they went through their daily rotation a single command/script was run which would produce a brief report of any errors contained within any of the Oracle Alert logs.  This way rather than an email report for every alert log I could get a single email report detailing any issues in the alert log.

The logadm man page suggests grouping could be done but I couldn't find information on it so I experimented and following seems to work.  Logadm Config file is "/etc/logadm.conf"

# Oracle Alert  Logs
# In this config the Alert logs are  grouped together.
ORACLE_ALERT_LOGS -C 0  -a /home/oracle/alert_log_report.sh -c -p 1d -s 1b -t  '/var/log/oracle/$nodename_$basename.%Y%m%d' \
/path/to/first/db/alert_log \
/path/to/second/db/alert_log

1st time the above config is executed it will rotate and archive /path/to/first/db/alert_log & /path/to/second/db/alert_log into /var/log/oracle with $nodename prefix and YYYYMMDD date suffix.  As these 2 logfiles are group together as ORACLE_ALERT_LOGS the script alert_log_report.sh is executed after both logfiles are rotated, this script can be used to send a daily summary of any Oracle errors.

# Oracle Alert  Logs
# In this config the Alert logs are  grouped together.
ORACLE_ALERT_LOGS< -C 0  -a /home/oracle/alert_log_report.sh -c -p 1d -s 1b -t  '/var/log/oracle/$nodename_$basename.%Y%m%d' \
/path/to/first/db/alert_log \
/path/to/second/db/alert_log

# These lines are added 1st time logadm is executed and used by the
# app to track when next to rotate the logs, i.e. if a rotation 
# period of 1 week was set with "-p 1w" logadm wouldn't rotate these
# 2 log files until Fri 2nd Oct 2009
/path/to/first/db/alert_log  -P 'Fri Sep 25 04:10:00 2009'
/path/to/second/db/alert_log  -P 'Fri Sep 25 04:00:00 2009'

I got most this info from http://docs.sun.com/app/docs/doc/816-5166/logadm-1m?a=view

Explanation of the other params/switches passed to logadm

–s 1b switch which means logs are only rotated if greater than 1 byte.  so logs not needlessly being rotated.

-C 15 is log retention period, here its 15 logs (14 archived + current log)  
–C 0  This turns off the deleting of retained logs, idea being that we keep all logs in /var/log/archives and maybe at some point in the future have a process of archiving them to centralised log server.

-P 'Wed Sep 23 10:03:43 2009' 
This is internal switched used by logadm, when it rotates a log it writes the Time Stamp back into the "logadm.conf" file.  It then uses this timestamp as the base for deciding when the weekly rotation is due.  NOTE: TIMESTAMP MUST BE EXACTLY IN ABOVE FORMAT  

-c is nice feature especially for likes of Oracle's listener.log;  It is copied 1st and then truncated.

-p 1w is a period of 1 week before next rotation.
-p 1d is a period of daily log rotation.

-t '/var/log/archives/$basename.%Y%m%d' 
is the destination and file format of the rotated logs.  I thought it was good idea if they all went into a dedicated log archive area and that they had YYYY-MON-DD suffix.  

-a /home/oracle/alert_log_report.sh The "-a" switch tells logadm to execute this command after the logs have been rotated. e.g. you might use following when rotating the ssh daemon logs -a kill –HUP `cat /etc/run/sshd.pid

 -V is incredibly useful as it validates the configuration file

No comments: