[SOLVED] I ain't got no syslogd on AIX?

NevemTeve · 02-12-2015, 02:58 AM

Q: Why don't I have syslogd-files in /var/log like messages or warnings?
A: AIX has other ways to handle messages (which I couldn't find out yet), but you can edit your /etc/syslog.conf files and add the missing entries, eg:

Code:

*.warning /var/log/warning.log rotate size 1m time 1m compress
*.info    /var/log/message.log rotate size 1m time 1m files 4 compress

Before you restart syslogd (kill -HUP <syslogdpid> should be enough), manually create these files:

Code:

touch /var/log/warning.log
touch /var/log/message.log

NevemTeve · 02-12-2015, 11:33 PM

Note: errpt is the AIX-specific utility to view the OS-messages.

wingnut64 · 02-13-2015, 09:21 PM

Some more syslog tips for AIX:

If you want a more capable syslog implementation, AIX 6.1 TL 8 and 7.1 also add the ability to use rsyslog instead of the default syslogd. It's missing some functionality but is a big improvement over the stock version if you want more features. It's a separate fileset you need to download from IBM's Web Download Pack for AIX.

If you want to integrate the AIX's excellent built in error notification facility with syslog, you can do something like the below example.

File /etc/errnotify.odm:

Code:

errnotify:
  en_name = "errnotify_syslog"
  en_persistenceflg = 1
  en_method = "/etc/errnotify_syslog.sh $1 $2 $3 $4 $5 $6 $7 $8 $9"

Script /etc/errnotify_syslog.sh:

Code:

#!/usr/bin/ksh

# $1    Sequence number from the error log entry
# $2    Error ID from the error Log entry
# $3    Class from the error log entry
# $4    Type from the error log entry
# $5    Alert flags from the error log entry
# $6    Resource name from the error log entry
# $7    Resource type from the error log entry
# $8    Resource class from the error log entry
# $9    Error label from the error log entry

typeset dayt="$(date)"
typeset node="$(errpt -a -l $1 | awk '/Node Id:/ {print $3}')"
typeset desc="$(errpt -a -l $1 | awk '/Description/,/^$/' | sed -n '2p')"
typeset data="$(errpt -a -l $1 | awk '/Detail Data/,/^$/' | tr '\n' ' ')"

# Inject message into syslog

typeset sev
if [[ $4 = "INFO" && $3 != "H" ]] ; then
        sev="notice"
elif [[ $4 = "TEMP" && $3 = "O" ]] ; then
        sev="info"
else
        sev="emerg"
fi
typeset prio="daemon.${sev}"

logger -p "$prio" -t "errpt:$9" "$4 $3 $8 $6 $7 '${desc}'"

Add to ODM:

Code:

# odmadd /tek/errnotify.odm

This will give you a syslog event something like:
2015-02-13 01:23:45 examplelpar daemon.info errpt: CLIENT_PMIG_STARTED INFO S 'Client Partition Migration Started'

If you have a central syslog server (you should!) this is a very easy way to setup monitoring of AIX hardware events, and is also a handy backup if you have some other monitoring solution in place.

http://www-01.ibm.com/support/knowle...4/rsyslogd.htm
https://www14.software.ibm.com/webap...xbp&lang=en_US