Rotation Rotation Rotation, format examples of log rotation in ITNM 3.9
kcstone 0600021BUE Visits (3452)
Using IBM Tivoli Network Manager with the most recent fixpack allows for the use of some great environmental variables for administering and controlling log and trace files.
The online documentation shows the setup or setting of the environmental variables, with references to any conflicts.
Take a look at some examples of questions from the field that are frequently seen.
The use of 'MAXSIZE' is the most common use of rotation. As a log or trace reaches the MAXSIZE it is renamed to '_old' and a new file of the original name is created. Essentially you have saved the last 1 gigabyte of data for a log or trace, plus the most recent data. When the new log or trace file reaches 1 gigabyte, the _old is removed, the new file becomes the _old, and again we begin to build the log or trace again.
If you are using a particular 'debug level' for example 'debug 4' then any rotation that occurs the new file continues at debug 4.
Sometimes a log or trace '_old' file is larger than 1 gigabyte from the example above. This can occur as a file approaches maxsize and the log or trace makes a single write to the file, and it goes over 1 gigabyte. A busy file at debug 4 like 'ncp_g_event' trace file might make a small spike over 1 gigabyte from the maxsize example above.
Log rotation can also occur over time. When the above example is used, we'll save logs and traces by the FORMAT as specified above, and the rotation will occur at midnight (00:00 hours). Take a look at log and trace files the next day.
-rw-r--r-- 1 netcool ncoadmin 383 Jul 29 16:58 ncp_
Notice above no timestamp at midnight. Since this file has not changed in size from 16:58 to 00:00 no rotation occurs. This makes sense there would be nothing new in the file.
rw-r--r-- 1 netcool ncoadmin 2394083 Jul 30 09:48 ncp_
Log was active from 29 Jul and at 00:00 (23:59) it was written, and FORMAT added. The data for 30 July is in the file with no date FORMAT at the end.
-rw-r--r-- 1 netcool ncoadmin 228 Jul 30 08:17 ncp_
The example above no activity occurred until after 00:00. Once this activity occurs the log is written with a FORMAT ending 30 July at 08:17. If this write does not occur now, then potentially a third day gets appended here.
In conclusion with the FORMAT, you will not always see a write with FORMAT, and you will not always see a write with FORMAT occur at the time 00:00. It depends on the time of the activity on the log or trace file.