System hang
SRC commands
Description
startsrc Starts a subsystem, group of subsystems, or a subserver stopsrc Stops a subsystem, group of subsystems, or a subserver lssrc Gets the status of a subsystem, group of subsystems, or a
subserver
Each entry in the /etc/syslog.conf file must consist of two parts:
A selector field to determine the message priorities to which the line applies
An action
Each line can contain an optional part:
Rotation
The fields must be separated by one or more tabs or spaces.
The selector field names a facility and a priority level. Separate facility names with a comma. Separate the facility and priority-level portions of the selector field with a period. Separate multiple entries in the same selector field with a
semicolon (;). To select all facilities, use an asterisk (*).
The Action field identifies a destination (file, host, or user) to receive the messages. If routed to a remote host, the remote system will handle the message as indicated in its own configuration file. To display messages on a user's terminal, the Destination field must contain the name of a valid, logged-in system user.
The Rotation field identifies how rotation is used. If the Action field is a file, then rotation can be based on size or time, or both. You can also compress and archive the rotated files.
Each message is one line. A message can contain a priority code, marked by a digit enclosed in angle braces (< >) at the beginning of the line. Messages longer than 900 bytes may be truncated.
Use the following system facility names in the Selector field:
kern Kernel
user User level
mail Mail subsystem
daemon System daemons
auth Security or authorization
syslog syslogd daemon
lpr Line-printer subsystem
news News subsystem
uucp uucp subsystem
* All facilities
Use the following message priority levels in the Selector field. Messages of the specified priority level and all levels above it are sent as directed.
emerg Specifies emergency messages (LOG_EMERG). These messages are not distributed to all users. LOG_EMERG priority messages can be logged into a separate file for reviewing.
alert Specifies important messages (LOG_ALERT), such as a serious hardware error. These messages are distributed to all users.
crit Specifies critical messages not classified as errors (LOG_CRIT), such as improper login attempts.
LOG_CRIT and higher-priority messages are sent to the system console.
err Specifies messages that represent error conditions (LOG_ERR), such as an unsuccessful disk write.
warning Specifies messages for abnormal, but recoverable, conditions (LOG_WARNING).
notice Specifies important informational messages
(LOG_NOTICE). Messages without a priority designation are mapped into this priority message.
info Specifies informational messages (LOG_INFO). These messages can be discarded, but are useful in analyzing the system.
debug Specifies debugging messages (LOG_DEBUG). These messages may be discarded.
none Excludes the selected facility. This priority level is useful only if preceded by an entry with an asterisk (*) in the same selector field.
Use the following message destinations in the Action field.
File name Full path name of a file opened in append mode
@host name Host name, preceded by an at sign (@) User[, User][...] User names
* All users
Use the following rotation keywords in the Rotation field.
rotate This keyword must be specified after the Action field.
size This keyword specifies that rotation is based on size. It is followed by a number and either a k (kilobytes) or m (megabytes).
time This keyword specifies that rotation is based on time. It is followed by a number and either an h (hour), d (day), w (week), m (month), or y (year).
files This keyword specifies the total number of rotated files. It is followed by a number. If not specified, then there is an unlimited number of rotated files.
compress This keyword specifies that the saved rotated files will be compressed.
archive This keyword specifies that the saved rotated files will be copied to a directory. It is followed by the directory name.
Following is an example of a /etc/syslog.conf configuration file modification to send all system messages, except those from the mail facility, to a host named server4. Type:
*.debug;mail.none @server4
6.7 Quiz
The following assessment questions help verify your understanding of the topics discussed in this chapter.
1. A system has been experiencing intermittent problems. Which of the following procedures should be performed to determine if the problem has been occurring at a specific time or frequency rate?
A. Check the error log.
B. Look at the SMIT log.
C. Talk to all of the users.
D. Look at the crontab file.
2. Which of the following should be used as the device for reporting and buffering errors with time stamps?
A. /etc/error B. /dev/error C. /usr/bin/error
3. A system operator accidentally deleted the error log with the errclear 0 command before backing it up to a file. Which of the following procedures should be performed to retrieve the data?
A. errpt -v
B. errpt -i /var/adm/ras/errlog C. cat /var/adm/ras/errlog
D. The data is lost and cannot be retrieved.
4. The syslogd daemon is typically started by:
A. /etc/inetd B. /etc/rc.tcpip C. /etc/rc.boot D. /etc/inittab
5. The default /etc/syslog.conf configuration specifies that messages be logged for which of the following facilities?
A. auth B. kern C. none D. daemon
6. The dodisk command is part of which fileset?
A. bos.adt.samples B. devices.scsi.disk.rte C. bos.acct
D. bos.rte.filesystems
7. To be able to monitor disk usage on a per-user basis, which of the following commands needs to be run?
A. df
B. fileplace C. dodisk D. delta
8. Which of the following options is the valid combination of selector, action, and rotation to use in the /etc/syslog.conf configuration file?
A. *.debug, @hostname, archive B. system.alert, *, backup
C. system.none, process ID, directories D. tcp.none, process ID, files
6.7.1 Answers
The following are the preferred answers to the questions provided in this section.
1. A 2. B 3. D 4. B 5. C 6. C 7. C 8. A
6.8 Exercises
The following exercises provide sample topics for self study. They will help ensure comprehension of this chapter.
1. Describe the two methods the errpt command uses to process a report.
2. Once the errclear command has been run to clear all entries in the error report, what is the only way to restore the error log?
3. What is the file name for the error log and the directory where it is kept?
Chapter 7.