No, Howard, you cannot and that is why I say you should be editing the
trapd.log.old files after the fact.
Trapd splits the log on size rather than date. And he keeps a byte count in
memory. When he is restarted, he gets the byte count of the existing file and
adds from there and he does not re-check the file size again because he is
keeping his own count. He does not expect the actual file to be altered while he
is up (why should he, since the OS has given him a good return code on every
write?) . So if you mess with the trapd.log file while trapd is up, you can
throw the counts off and results are unpredictable. If you want logs split by
date rather than size, you should wait until all the data has been written or
make copies of the existing logs and manipulate those, or you may get some very
strange results and lose traps. Not to put to fine a point on it, what you are
doing by manipulating trapd.log while trapd is writing to it is not supported.
You may find that the only way you can upload these trap files successfully is
the day after the month ends and not when it ends. Do you see what I am saying
here?
In the long run you could send an enhancement request to netview@tivoli.com to
request a split-by-date rather than a split-by-size feature in trapd.
My two cents.
James Shanks
Tivoli (NetView for UNIX) L3 Support
howard <howard@howard-allison.com> on 12/02/99 03:15:49 AM
Please respond to "howard@howard-allison.com" <howard@howard-allison.com>
To: NV-L@UCSBVM.UCSB.EDU
cc: (bcc: James Shanks/Tivoli Systems)
Subject: AW: Event logs limitation
James, you wrote:
>>trapd keeps a count of every trap he writes and he adds the size in bytes
to
>>what he has already written. So as long as he handles the switching of
>>trapd.log to trapd.log.old, there is no way you can lose traps, because
he won't
>>write the new one to the file until the old log has been switched.
I've written a script which parses the trapd log, and generates an
availability report based on various agent traps(not netmon) (DLCI,LINK
UP/DOWN, etc.). I have to rotate the logs with cron, otherwise the reports
might not be complete on the first of the month(almost certainly not,
actually), and the monthly cron job would reflect incomplete data.
Currently I check for the backup file, and process it if it exists.....but
it would be nice if I could reset this byte count somehow after renaming
the log file - is that possible?
Thanks,
Howard Allison
Softcom Consulting
Vienna
|