Does the F5 delete ungzip'd log files

apologies -realised my first explaination is as clear as mud. Here are the steps I did:

 

 

1) SSH to LTM running 9.4 and go in to the /var/log folder

 

2) Unzipped the previous days log file :

 

gzip -d ltm.1.gz

 

 

fter viewwing the file forgot to recompress it so ended up leaving the log in /var/log/ (so full path of the file was /var/log/ltm.1 )

 

 

3) Came back the following day and the ltm.1 file was missing from the folder and I can't seem to see it in any of the archives

 

 

This happened on two LTM's so presuing this is by design to keep logs files in order but was wondering if anyone can explain what happened to the log files?

 

 

thanks

Under normal circumstances I wouldn't expect the unzipped file to ever be removed. You can try searching for a solution on the logrotate script on AskF5 and/or check the config on your unit for details on log management.

 

 

Aaron

ssh to it

 

bigpipe shell

 

logrotate list all

 

 

pay attention to the rotate line

 

also go to /var/run/config

 

and look at the logrotate_common.conf and logrotate.conf

 

but I think what you are looking for is in /var/run/config/logrotate.d/syslog-ng

 

 

Hope it helps.

For details on the logrotate options, you can also check the help:

 

 

b logrotate help

 

 

SOL7115 also has more info:

 

 

SOL7115: Managing log files on the BIG-IP system

 

https://support.f5.com/kb/en-us/solutions/public/7000/100/sol7115.html

 

 

Aaron

Watcher60,

 

 

I tested the scenario that u mentioned, and indeed ltm.1 file was gone the next day.

 

If I add nocompress /var/run/config/logrotate.d/syslog-ng then ltm.1 file will be there.

 

So it looks like the compression touch the ltm.1.

 

 

 

THIS IS AN AUTO-GENERATED FILE -- DO NOT EDIT!!!

 

 

Use the bigpipe shell utility to make changes to the system configuration.

 

For more information, see bigpipe logrotate help.

 

/var/log/ltm /var/log/gtm /var/log/messages /var/log/secure /var/log/maillog /var/log/boot.log /var/log/cron /var/log/pktf

 

ilter /var/log/em /var/log/asm /var/log/tmm /var/log/tmm[0-9] /var/log/daemon.log /var/log/kern.log /var/log/bcm56xxd /var

 

/log/audit /var/log/user.log /var/log/wa/pvac.log /var/log/wa/comm_srv.log /var/log/confpp.log {

 

nocompress

 

missingok

 

notifempty

 

sharedscripts

 

postrotate

 

/bin/kill -HUP `cat /var/run/syslog-ng.pid 2> /dev/null` 2> /dev/null || true

 

endscript

 

}

 

Guys - many thanks for the responses (long weekend hence hadn't had chance to dig)

 

 

I'm presuming then it must match any ltm* file.

 

 

Anyway - thanks again for the response - as always sounds like I have some reading to do!

 

 

W60