OS-SCO-Logging

On SCO OpenServer 5.0.7 /var/adm/syslog...

See Also 

OS-SCO

Logs

system

1. /var/adm/syslog

httpd

1. /usr/lib/apache/logs/access_log
2. /usr/lib/apache/logs/error_log

Cleanup

/usr/lib/apache/logs

# cd /usr/lib/apache/logs # ls -l *log* -rw------- 1 root sys 1829033783 Mar 23 17:13 access_log -rw------- 1 root root 1853077446 Mar 23 17:13 error_log # /etc/rc2.d/P90apache stop

filter

Keep only this year and last year:

# THISYEAR=`date +%Y` && LASTYEAR=`expr $THISYEAR - 1` # grep -E "^([0-9][0-9]*[. ]){4}([-] ){2}[[][0-9]{2}[/][A-Z][a-z]{2}[/]($LASTYEAR|$THISYEAR)([:][0-9]{2}){3} [-][0-9]{4}[]]" access_log >access_log.tmp # grep -E "^[[]([A-Z][a-z]{2} ){2}([ 0-9]{2}[: ]){4}($LASTYEAR|$THISYEAR)[]]" error_log >error_log.tmp # head -1 access_log.tmp; tail -1 access_log.tmp # head -1 error_log.tmp; tail -1 error_log.tmp # mv access_log.tmp access_log # mv error_log.tmp error_log # /etc/rc2.d/P90apache start

split

split makes large files manageable by breaking them into smaller pieces, but does not inherently break on a time period without additional processing of the pieces:

# split -h Usage: split [-l linecount | -linecount | -b n[k|m]] [-a suffix_length] [file [name]] # /etc/rc2.d/P90apache stop # split -b 512m access_log access_log. # split -b 512m error_log error_log. # ls -l *log* -rw------- 1 root sys 1829035204 Mar 23 17:28 access_log -rw-rw-rw- 1 root sys 536870912 Mar 23 17:18 access_log.aa -rw-rw-rw- 1 root sys 536870912 Mar 23 17:20 access_log.ab -rw-rw-rw- 1 root sys 536870912 Mar 23 17:21 access_log.ac -rw-rw-rw- 1 root sys 218421859 Mar 23 17:22 access_log.ad -rw------- 1 root root 1853079301 Mar 23 17:28 error_log -rw-rw-rw- 1 root sys 536870912 Mar 23 17:24 error_log.aa -rw-rw-rw- 1 root sys 536870912 Mar 23 17:26 error_log.ab -rw-rw-rw- 1 root sys 536870912 Mar 23 17:27 error_log.ac -rw-rw-rw- 1 root sys 242466565 Mar 23 17:28 error_log.ad

Note that split does not cut the log at line breaks.

# head -2 access_log.tmp; tail -1 access_log.tmp # head -2 error_log.tmp; tail -1 error_log.tmp # mv access_log.ad access_log # mv error_log.ad error_log # /etc/rc2.d/P90apache start

Rotation

Rotation is not used because it is not a 'stock' configuration of the Apache install on SCO. A rotation option that could be easily implemented by just configuration changes [without adding extra scripting, ...] was not found. A daily rotation that created a new log file each day of the month was found, but only resulted in keeping 30 days of history. This was implemented on an old server, but when it got rebuilt, it appeared that something wasn't working correctly and was constantly causing the Apache daemon to die, so was disabled. See also: /usr/lib/apache/conf/httpd.conf

# ErrorLog: The location of the error log file. # If you do not specify an ErrorLog directive within a <VirtualHost> # container, error messages relating to that virtual host will be # logged here. If you *do* define an error logfile for a <VirtualHost> # container, that host's errors will be logged there and not here. # # ErrorLog "| /usr/lib/apache/bin/rotatelogs /usr/lib/apache/logs/error_log.%d 86400 -360"

LogLevel

LogLevel and LogFormat are sometimes used to reduce volume. See also: /usr/lib/apache/conf/httpd.conf

# LogLevel: Control the number of messages logged to the error_log. # Possible values include: debug, info, notice, warn, error, crit, # alert, emerg. # # LogLevel warn LogLevel crit # # The following directives define some format nicknames for use with # a CustomLog directive (see below). # LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined # LogFormat "%h %l %u %t \"%r\" %>s %b" common LogFormat "%{Referer}i -> %U" referer LogFormat "%{User-agent}i" agent LogFormat "%h %t" common