wiki

On AIX it's important to control the size of such log files.

Syslog has his own mechanism to rotate his logs, but other log have to be rotate (purged) manually.

To do this task you can install a freeware: logrotate (coreutil is also required, and some other dependencies). Where download RPM packages

Here is the minimum list of files that can required a rotation:
/var/adm/wtmp, /var/adm/sulog, /var/adm/cron/log ….

[eco-aix61@root] /root> crontab -l
...
5 0 * * * /usr/sbin/logrotate /etc/logrotate.conf > /var/log/logrotate.log 2>&1

Into the configuration file you have first the global policies that applies to all files, but you can change it for each file. How to specify a policy ?
Some log files don't support to be moved and recreate, then choose copytruncate. If you want a rotation based on the log file size, then specify the right value; you can choose a period to rotate a file; the number of version you want to keep; choose a compression if you don't need to read old log files…

[eco-aix61@root] /var/log> cat /etc/logrotate.conf
# see "man logrotate" for details
# rotate log files weekly
weekly

# keep 4 weeks worth of backlogs
rotate 4

# create new (empty) log files after rotating old ones
copytruncate

# don't report error if file doesn't exists
missingok

# use date as a suffix of the rotated file
#dateext

# uncomment this if you want your log files compressed
compress

# RPM packages drop log rotation information into this directory
include /etc/logrotate.d

[eco-aix61@root] /var/log> cat /etc/logrotate.d/system.conf
# Most common AIX files
/var/adm/wtmp {
    copytruncate
    su adm adm
    rotate 10
    weekly
}

/var/adm/sulog {
    copytruncate
    su root system
    rotate 10
    weekly
}

/var/adm/cron/log {
    copytruncate
    rotate 10
    weekly
}

/etc/security/aixpert/log/aixpert.log {
    copytruncate
    su root system
    rotate 2
    size=2M
}

[eco-aix61@root] /var/log> cat /etc/logrotate.d/mail.conf
# Rotate mail files, useful when nobody take care!!!
/var/spool/mail/* {
    su root mail
    size 10M
    copytruncate
    weekly
    rotate 4
    olddir /var/log/news/old
}

NOTE: I add the “su” parameter to prevent permission errors (bug in latest version of logrotate)

A log file is available, and contain the latest rotation date for each file.

[eco-aix61@root] /var/lib> cat logrotate.status
logrotate state -- version 2
"/var/adm/wtmp" 2012-5-8
"/tmp/test" 2012-5-8
"/var/adm/cron/log" 2012-5-8

In case of trouble, start manually logrotate with debug and verbose options:

/usr/sbin/logrotate -dv /etc/logrotate.conf

Change compression program

/tmp/output.log {
        size 1k
        copytruncate
        create
        compress
        compresscmd /bin/bzip2
        compressext .bz2
        rotate 4
}

$ cat /etc/logrotate.d/app

/var/log/app/*.old {
  hourly
  rotate 0
  firstaction
    /usr/bin/find /var/log/app/ -name "*.old" -mtime +1 -delete
  endscript
  nocreate
  missingok
  notifempty
}