HP-UX log file too big?

[Nighthawk]

I'm one of the system administrators on a UNIX box running HP-UX 11.0. It's got 128MB of RAM and a 200 MHz HP-Pa RISC CPU.

Every time Cron tells Analog (web stats program) to run, it crashes with an error message of "coredump" in the file access_log (main log of who's visiting web sites). Bad thing.

Any ideas of how to fix this? I am assuming that the log file is too big and needs to be archived and a new access_log started. Will this work?

[psyklone]

well what you may want to do first is check and what exactly that cronjob is doing. if it's calling a web usage analyzer then it's possible that this program may be running a grep/minigrep on /var/log/messages and picking out key words for reporting. if it's running minigrep, change it to grep as minigrep has many issues with performance. if that doesn't do it then i'll tell you how to run a backtrace on the core files to get a better idea what's going on. also, move the core files out of the way so that they are not interfering with the process.

[psyklone]

well what you may want to do first is check and what exactly that cronjob is doing. if it's calling a web usage analyzer then it's possible that this program may be running a grep/minigrep on /var/log/messages and picking out key words for reporting. if it's running minigrep, change it to grep as minigrep has many issues with performance. if that doesn't do it then i'll tell you how to run a backtrace on the core files to get a better idea what's going on. also, move the core files out of the way so that they are not interfering with the process.

[Nighthawk]

Cron is saying /web/analog/analog +gnormal.cfg, (yes, no space between g and normal) to run through the web access log /usr/local/apache/logs/access_log. We can set up hosts to exclude, so it must be doing a grep of some sort, but it's probably something with analog itself.

One possible problem that I see in the config file that analog is using is that it's not only reading the current access_log but also gzipped backups in another directory. It could be that it's just running through too much data, or possibly it isn't set up correctly.

It only fails when doing a general stats run on the access_log. Each school has a subdirectory and their own specialized config file. None of those are messing up.


One of the other sysadmins might have upgraded the analog program and not set it up correctly.

http://www.analog.cx