Forum Discussion

JB_41040's avatar
JB_41040
Icon for Nimbostratus rankNimbostratus
Jul 07, 2011

Custom WA hit log rotation

I am testing a BigIP 3900 (version: 10.2.1.297) deployment and am struggling with the following

 

 

1) Is there a way to send the WA hit logs to a remote syslog server?

 

 

2) Can i customize the log rotation schedule? Looks like, the default is to check every 1 hour and start a new log file if it is larger than 10 MB but we generate gigs of log files and i need to control the rotation schedule and since there is not much storage on the 3900, i am trying to start a new log file every 3 hours regardless of size and then move it to a another server.

 

 

 

Any ideas/thoughts are welcome.

 

 

Thanks

 

JB

 

management
monitoring
  • JRahm's avatar
    JRahm
    Icon for Admin rankAdmin
    Aug 08, 2011
    I'm not deeply familiar with WA...where are the logs stored? If in the filesystem in plaintext ( /var/log (or a subdir)?), you can configure syslog-ng to send logs as they happen off box via a remote destination. Or, you can write a bash script to ftp/scp the files via a custom cron job (yes, you can do this). Caveats to any system changes NOT done in TMM: any hotfix/upgrade will blow your configuration away, so make sure you document and archive your configuration for rebuild after either of these occurrences. The wiki has backup scripts (like this one: Click Here) that you could easily alter for ftp/scp'ing of log archives.

     

     

    HTH...Jason
  • JB_41040's avatar
    JB_41040
    Icon for Nimbostratus rankNimbostratus
    Aug 22, 2011
    the logs are under /var/log/wa/access. the internal log rotation wasn't working for me so i wrote a custom script that was rotating the logs every three hours ( i removed the /etc/cron.hourly/wa_logrotate) but i have run into this use where the logs stop writing once the file size reaches 2 GB. i have increase the frequency to every 2 hours to counter that but may not be enough once our web traffic peaks in the school season. does anyone know if there is some limit of file size on the 3900s?