..... forgot the list ....
----- Forwarded by Oliver Bruchhaeuser/Germany/Contr/IBM on 10.06.2002
11:47 -----
Oliver
Bruchhaeuser To: "Judy Stobby"
<jstobby@co.el-dorado.ca.us>
cc:
10.06.2002 11:44 From: Oliver
Bruchhaeuser/Germany/Contr/IBM@IBMDE
Subject: Re: FW: [nv-l] /var
file system & snmpd.log(Document link: Bruchhaeuser Oliver)
Judy,
you may want to look what files are modified in the last day to get a
better idea
who is causing /var to run full:
find /var -mtime 1 -ls | sort -n +6 -7 -r
Kind regards
Oliver Bruchhaeuser
Tivoli NetView EMEA L2 Support
IBM Deutschland GmbH - ITS Tivoli - Dept. 7977 - Hechtsheimer Str. 2 -
55131 Mainz - Germany
Phone: +49-6131-84-5108 - Fax: +49-6131-84-6585 - email:
bruchhae@de.ibm.com
Need help with Tivoli Software Products?
Ask Tivoli!
http://www.tivoli.com/asktivoli (login with your customer account)
"Judy Stobby"
<jstobby@co.el-do To:
<nv-l@lists.tivoli.com>
rado.ca.us> cc:
Subject: FW: [nv-l] /var file
system & snmpd.log
07.06.2002 16:58
Please respond to
"Judy Stobby"
Sorry, I meant to send this to the list.
-----Original Message-----
From: Judy Stobby [mailto:jstobby@co.el-dorado.ca.us]
Sent: Friday, June 07, 20027:55 AM
To: 'jshanks@us.ibm.com'
Subject: RE: [nv-l] /var file system & snmpd.log
James,
Thanks for the response. The message I received from netmon was just that
it had stopped and to restart it. Yesterday the /var file system filled up
again, so I decided to do a shutdown, after I increased the file system
again. When the system came back up, it the /var file system was only at
10%, and still is this morning. Hidden files somewhere I suspect, but I
really do not know.
The reason I wanted to delete lines is I wanted to keep the original file
in tact, not really necessary I know.
-----Original Message-----
From: jshanks@us.ibm.com [mailto:jshanks@us.ibm.com]
Sent: Friday, June 07, 20023:03 AM
To: nv-l@lists.tivoli.com
Subject: Re: [nv-l] /var file system & snmpd.log
Judy
I am confused here. Take a look at the man page for snmpd.conf.
If you set logging level to zero, then you are essentially turning logging
off, except for failures and exceptions. So there may not be any new
entries. There certainly would not be anything like the volume you would
have with level=3.
But I am puzzled as to why you did not just start a new log. There is no
need to edit the old one. Just rename it and restart snmpd -- he'll create
a new one. You can move, archive, or trash the old snmpd log file as you
like.
I take it that you know you can stop snmpd on AIX at any time using
stopsrc -s snmpd
and then restart with
startsrc -s snmpd
so this is easy to do.
As snmpd is an OS daemon, AIX's in this case, and not NetView's, I don't
know what he will do if you run out of space in the file system that you
have told him to log to. It is possible that he will just stop, or get
stuck in a loop trying to write an error message to the log that he cannot
write to the log. I don't know. That's just speculation. But if you enable
logging, I'd make sure you note that somewhere and check on your space
periodically.
What message did you get from netmon which led to this? That he could not
talk to snmpd? There is no "dependency" on the /var file system in NetView,
but there sure is one for snmpd, and if he isn't working right, then netmon
and most of NetView won't work well either.
James Shanks
Level 3 Support for TivoliNetView for UNIX and NT
TivoliSoftware / IBM Software Group
[IMAGE]"Judy Stobby" <jstobby@co.el-dorado.ca.us>
[IMAGE] [IMAGE] [IMAGE]
"Judy Stobby" To:
<jstobby@co.el-dorado.ca. <nv-l@lists.tivoli.com>
us> cc:
Subject: [nv-l] /var file
06/05/0205:40 PM system & snmpd.log
Hi,
I'm not sure if the problems I've seen lately are related to netview or
aix, but maybe someone has a clue as to what happened. Our system is
running netview 7.1.1 on aix 4.3.3 ML9. One morning last week netmon daemon
stopped running with a message to restart it. I looked at the file systems
and /var and /usr/OV were at 100%. I deleted the log files in /usr/OV/log
and increased the file systems, and restarted netmon. Then the next day
/var was again at 100%, and netmon daemon stopped again. I increased the
file system a little more which took care of it, but I would like to know
why the /var file system filled up. What is the relationship between
Netview and /var? I turned on netmon tracing with netmon M -1, and then
looked at the trace files. I saw a lot of querying HP Jet Direct cards,
with public still as the community, but nothing that seemed to be failing.
I had turned on SNMP logging (level 3) because the event log was filling up
with authentication errors, so I tired to look at the snmpd.log, which gave
me the error too large to fit in file system. So I move the snmpd.log to
/home and change the location is snmpd.conf, also changing the logging back
to level 0.
Since this move, there have not been any entries in the snmpd.log. I
stopped and restart the daemon thinking this would make the snmpd.conf file
be read again. But it is still not logging any entries. I have not found
any documentation regarding moving the location of this file along with any
special commands to restart logging. The file is full of entries that go
way back, is it possible to use the editor to delete old entries out of
this file?
Thanks for any tips anyone can share.
image001.gif
Description: GIF image
image002.gif
Description: GIF image
image003.gif
Description: GIF image
image004.gif
Description: GIF image
|
