[Top] [All Lists]

Re: FW: [nv-l] /var file system & snmpd.log

To: <nv-l@lists.tivoli.com>
Subject: Re: FW: [nv-l] /var file system & snmpd.log
From: "Oliver Bruchhaeuser" <oliver.bruchhaeuser@de.ibm.com>
Date: Mon, 10 Jun 2002 11:46:23 +0200
..... forgot the list ....
----- Forwarded by Oliver Bruchhaeuser/Germany/Contr/IBM on 10.06.2002
11:47 -----
                      Bruchhaeuser             To:      "Judy Stobby" 
                      10.06.2002 11:44         From:    Oliver 
                                               Subject: Re: FW: [nv-l] /var 
file system & snmpd.log(Document link: Bruchhaeuser Oliver)              


you may want to look what files are modified in the last day to get a
better idea
who is causing /var to run full:

find /var -mtime 1 -ls | sort -n +6 -7 -r

Kind regards

Oliver Bruchhaeuser
Tivoli NetView EMEA L2 Support

IBM Deutschland GmbH - ITS Tivoli - Dept. 7977 - Hechtsheimer Str. 2 -
55131 Mainz - Germany
Phone: +49-6131-84-5108 - Fax: +49-6131-84-6585 - email:

Need help with Tivoli Software Products?
Ask Tivoli!
http://www.tivoli.com/asktivoli (login with your customer account)

                      "Judy Stobby"                                             
                      <jstobby@co.el-do        To:       
                      rado.ca.us>              cc:                              
                                               Subject:  FW: [nv-l] /var file 
system & snmpd.log                                                     
                      07.06.2002 16:58                                          
                      Please respond to                                         
                      "Judy Stobby"                                             

Sorry, I meant to send this to the list.

-----Original Message-----
From: Judy Stobby [mailto:jstobby@co.el-dorado.ca.us]
Sent: Friday, June 07, 20027:55 AM
To: 'jshanks@us.ibm.com'
Subject: RE: [nv-l] /var file system & snmpd.log


Thanks for the response.  The message I received from netmon was just that
it had stopped and to restart it.  Yesterday the /var file system filled up
again, so I decided to do a shutdown, after I increased the file system
again.  When the system came back up, it the /var file system was only at
10%, and still is this morning.   Hidden files somewhere I suspect, but I
really do not know.

The reason I wanted to delete lines is I wanted to keep the original file
in tact, not really necessary I know.

-----Original Message-----
From: jshanks@us.ibm.com [mailto:jshanks@us.ibm.com]
Sent: Friday, June 07, 20023:03 AM
To: nv-l@lists.tivoli.com
Subject: Re: [nv-l] /var file system & snmpd.log


I am confused here. Take a look at the man page for snmpd.conf.
If you set logging level to zero, then you are essentially turning logging
off, except for failures and exceptions. So there may not be any new
entries. There certainly would not be anything like the volume you would
have with level=3.
But I am puzzled as to why you did not just start a new log. There is no
need to edit the old one. Just rename it and restart snmpd -- he'll create
a new one. You can move, archive, or trash the old snmpd log file as you
I take it that you know you can stop snmpd on AIX at any time using
stopsrc -s snmpd
and then restart with
startsrc -s snmpd
so this is easy to do.

As snmpd is an OS daemon, AIX's in this case, and not NetView's, I don't
know what he will do if you run out of space in the file system that you
have told him to log to. It is possible that he will just stop, or get
stuck in a loop trying to write an error message to the log that he cannot
write to the log. I don't know. That's just speculation. But if you enable
logging, I'd make sure you note that somewhere and check on your space

What message did you get from netmon which led to this? That he could not
talk to snmpd? There is no "dependency" on the /var file system in NetView,
but there sure is one for snmpd, and if he isn't working right, then netmon
and most of NetView won't work well either.

James Shanks
Level 3 Support for TivoliNetView for UNIX and NT
TivoliSoftware / IBM Software Group

[IMAGE]"Judy Stobby" <jstobby@co.el-dorado.ca.us>

   [IMAGE]      [IMAGE]                         [IMAGE]                    
                "Judy Stobby"                   To:                        
                <jstobby@co.el-dorado.ca.       <nv-l@lists.tivoli.com>    
                us>                             cc:                        
                                                Subject: [nv-l] /var file  
                06/05/0205:40 PM                system & snmpd.log         


I'm not sure if the problems I've seen lately are related to netview or
aix, but maybe someone has a clue as to what happened. Our system is
running netview 7.1.1 on aix 4.3.3 ML9. One morning last week netmon daemon
stopped running with a message to restart it. I looked at the file systems
and /var and /usr/OV were at 100%. I deleted the log files in /usr/OV/log
and increased the file systems, and restarted netmon. Then the next day
/var was again at 100%, and netmon daemon stopped again. I increased the
file system a little more which took care of it, but I would like to know
why the /var file system filled up. What is the relationship between
Netview and /var? I turned on netmon tracing with netmon M -1, and then
looked at the trace files. I saw a lot of querying HP Jet Direct cards,
with public still as the community, but nothing that seemed to be failing.

I had turned on SNMP logging (level 3) because the event log was filling up
with authentication errors, so I tired to look at the snmpd.log, which gave
me the error too large to fit in file system. So I move the snmpd.log to
/home and change the location is snmpd.conf, also changing the logging back
to level 0.

Since this move, there have not been any entries in the snmpd.log. I
stopped and restart the daemon thinking this would make the snmpd.conf file
be read again. But it is still not logging any entries. I have not found
any documentation regarding moving the location of this file along with any
special commands to restart logging. The file is full of entries that go
way back, is it possible to use the editor to delete old entries out of
this file?

Thanks for any tips anyone can share.

Attachment: image001.gif
Description: GIF image

Attachment: image002.gif
Description: GIF image

Attachment: image003.gif
Description: GIF image

Attachment: image004.gif
Description: GIF image

<Prev in Thread] Current Thread [Next in Thread>

Archive operated by Skills 1st Ltd

See also: The NetView Web