Skip to content

[Open]Solaris logfiles and ZFS root

February 21, 2009

This week I had reason to want to see how often the script that controls the access hours of Sun Ray users actually did work so I went off to look in the messages files only to discover that there were only four and they only went back to January 11.

: pearson FSS 22 $; ls -l mess* -rw-r–r–   1 root     root       12396 Feb  8 23:58 messages -rw-r–r–   1 root     root      134777 Feb  8 02:59 messages.0 -rw-r–r–   1 root     root       53690 Feb  1 02:06 messages.1 -rw-r–r–   1 root     root      163116 Jan 25 02:01 messages.2 -rw-r–r–   1 root     root       83470 Jan 18 00:21 messages.3 : pearson FSS 23 $; head -1 messages.3 Jan 11 05:29:14 pearson pcplusmp: [ID 444295 kern.info] pcplusmp: ide (ata) instance #1 vector 0xf ioapic 0x2 intin 0xf is bound to cpu 1 : pearson FSS 24 $;  

I am certain that the choice of only four log files was not a concious decision I have made but it did make me ponder whether logfile management should be revisted in the light of ZFS root. Since clearly if you have snapshots firing logs could go back a lot futher:

: pearson FSS 40 $; head -1 $(ls -t /.zfs/snapshot/*/var/adm/message*| tail -1) Dec 14 03:15:14 pearson time-slider-cleanup: [ID 702911 daemon.notice] No more daily snapshots left : pearson FSS 41 $;  

It did not take long for this shell function to burst into life:

function search_log { typeset path if [[ ${2#/} == $2 ]] then         path=${PWD}/$2 else         path=$2 fi cat $path /.zfs/snapshot/*$path | egrep $1 | sort -M | uniq } 

Not a generalized solution but one that works when you root filesystem contains all your logs and if you remember to escape any globbing on the command line will search all the log files:

: pearson FSS 46 $; search_log block /var/adm/messages\* | wc       51     688    4759 : pearson FSS 47 $; 

There are two ways to view this. Either it it great that the logs are kept and so I have all this historical data or it is a pain as getting red of log files becomes more of a chore, indeed this is encouraging me to move all the logfiles into their own file systems so that the management of those logfiles is more granular.

At the very least it seems to me that OpenSolaris should sort out where it’s log files are going and end the messages going in /var/adm and move them to /var/log which then should be it’s own file system.

Advertisements

From → Solaris

Leave a Comment

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: