LOGS NOT UPDATING(logrotation)

[ericssonvietnam]

i have observed logs are not updating from past few days

[root@nagiosxi snmptt]# ls -ltr
total 13560
-rw-rw-r-- 1 snmptt snmptt 17040 Mar 16 00:02 snmptt.log-20170316
-rw-rw-r-- 1 snmptt snmptt 222 Mar 19 04:05 snmptt.log-20170320
-rw-rw-r-- 1 snmptt snmptt 605 Mar 20 16:33 snmptt.log-20170321
-rw-rw-r-- 1 snmptt snmptt 49207 Mar 24 01:17 snmpttunknown.log-20170324
-rw-rw-r-- 1 snmptt snmptt 202 Mar 24 03:44 snmpttsystem.log-20170324
-rw-rw-r-- 1 snmptt snmptt 63514 Mar 24 22:53 snmpttunknown.log-20170325
-rw-rw-r-- 1 snmptt snmptt 17040 Mar 25 00:02 snmptt.log-20170325
-rw-rw-r-- 1 snmptt snmptt 202 Mar 25 03:50 snmpttsystem.log-20170325
-rw-rw-r-- 1 snmptt snmptt 73847 Mar 26 01:29 snmpttunknown.log-20170326
-rw-rw-r-- 1 snmptt snmptt 202 Mar 26 03:20 snmpttsystem.log-20170326
-rw-rw-r-- 1 snmptt snmptt 145 Mar 26 03:20 snmpttsystem.log-20170327
-rw-rw-r-- 1 snmptt snmptt 1984 Mar 26 03:56 snmpttunknown.log-20170327
-rw-r--r-- 1 snmptt snmptt 1663339 May 21 03:12 snmptthandler.debug-20170521
-rw-r--r-- 1 snmptt snmptt 340 May 21 03:13 snmptt.debug-20170521
-rw-r--r-- 1 snmptt snmptt 1794764 May 22 03:25 snmptthandler.debug-20170522
-rw-r--r-- 1 snmptt snmptt 340 May 22 03:27 snmptt.debug-20170522
-rw-r--r-- 1 snmptt snmptt 1967310 May 23 03:36 snmptthandler.debug-20170523
-rw-r--r-- 1 snmptt snmptt 340 May 23 03:39 snmptt.debug-20170523
-rw-r--r-- 1 snmptt snmptt 1916665 May 24 03:25 snmptthandler.debug-20170524
-rw-r--r-- 1 snmptt snmptt 340 May 24 03:33 snmptt.debug-20170524
-rw-rw-r-- 1 snmptt snmptt 2537139 May 25 03:34 snmptt.log-20170525.gz
-rw-rw-r-- 1 snmptt snmptt 190 May 25 03:34 snmpttsystem.log-20170525.gz
-rw-rw-r-- 1 snmptt snmptt 150662 May 25 03:34 snmpttunknown.log-20170525.gz
-rw-rw-r-- 1 snmptt snmptt 0 May 26 03:47 snmptt.log
-rw-rw-r-- 1 snmptt snmptt 570627 May 26 03:48 snmptt.log-20170526.gz
-rw-rw-r-- 1 snmptt snmptt 0 May 26 03:48 snmpttsystem.log
-rw-rw-r-- 1 snmptt snmptt 0 May 26 03:48 snmpttunknown.log
-rw-rw-r-- 1 snmptt snmptt 166 May 26 03:48 snmpttsystem.log-20170526.gz
-rw-rw-r-- 1 snmptt snmptt 68690 May 26 03:48 snmpttunknown.log-20170526.gz
-rw-r--r-- 1 snmptt snmptt 106587 May 27 03:49 snmptthandler.debug-20170527.gz
-rw-r--r-- 1 snmptt snmptt 81 May 27 03:49 snmptt.debug-20170527.gz
-rw-r--r-- 1 snmptt snmptt 106412 May 28 03:16 snmptthandler.debug-20170528.gz
-rw-r--r-- 1 snmptt snmptt 81 May 28 03:16 snmptt.debug-20170528.gz
-rw-r--r-- 1 snmptt snmptt 108981 May 29 03:40 snmptthandler.debug-20170529.gz
-rw-r--r-- 1 snmptt snmptt 81 May 29 03:40 snmptt.debug-20170529.gz
-rw-r--r-- 1 snmptt snmptt 128338 May 30 03:45 snmptthandler.debug-20170530.gz
-rw-r--r-- 1 snmptt snmptt 0 May 30 03:45 snmptt.debug
-rw-r--r-- 1 snmptt snmptt 81 May 30 03:45 snmptt.debug-20170530.gz
-rw-r--r-- 1 snmptt snmptt 2397876 May 31 01:24 snmptthandler.debug

I have ran log rotate in debug mode but haven't found any error

[avandemore]

What do you mean "logs are not updating"? Is there some behavior happening that makes you expect some log file to be appended to and it is not? If so, can you provide more detail on that?

[ericssonvietnam]

What do you mean "logs are not updating"? Is there some behavior happening that makes you expect some log file to be appended to and it is not? If so, can you provide more detail on that?

Its updating now after running logrotate in debugging mode

But can you let me know what below message log state about the node suggest how it can be rectified:

Jun 2 04:24:48 nagiosxi snmptt[1942]: .1.3.6.1.6.3.1.1.5.5 Normal "Status Events" TBSMS1X1 - SNMP athentication failure
Jun 2 04:24:48 nagiosxi snmptt[1942]: .1.3.6.1.6.3.1.1.5.5 Normal "Status Events" TBSMS1X1 - SNMP athentication failure
Jun 2 04:24:48 nagiosxi snmptt[1942]: .1.3.6.1.6.3.1.1.5.5 Normal "Status Events" TBSMS1X1 - SNMP athentication failure
Jun 2 04:24:48 nagiosxi snmptt[1942]: .1.3.6.1.6.3.1.1.5.5 Normal "Status Events" TBSMS1X1 - SNMP athentication failure
Jun 2 04:24:48 nagiosxi snmptt[1942]: .1.3.6.1.6.3.1.1.5.5 Normal "Status Events" TBSMS1X1 - SNMP athentication failure
Jun 2 04:24:48 nagiosxi snmptt[1942]: .1.3.6.1.6.3.1.1.5.5 Normal "Status Events" TBSMS1X1 - SNMP athentication failure
Jun 2 04:24:49 nagiosxi snmptt[1942]: .1.3.6.1.6.3.1.1.5.5 Normal "Status Events" TBSMS1X1 - SNMP athentication failure
Jun 2 04:24:49 nagiosxi snmptt[1942]: .1.3.6.1.6.3.1.1.5.5 Normal "Status Events" TBSMS1X1 - SNMP athentication failure

these logs are very frequent causing message queue to drop message

[avandemore]

Please run the following:

Code: Select all

# tar czvf /tmp/snmptt.tar.gz /etc/snmp/ /var/log/snmptt/

Then attach or PM the file /tmp/snmptt.tar.gz

[tgriep]

The OID .1.3.6.1.6.3.1.1.5.5 translates to authenticationFailure.
This is an authentication failure trap that your device is sending.
What this means simply is that someone used an incorrect SNMP community to poll your device.
You will get such a trap each time this occurs.

Login to the host called TBSMS1X1 and see if it is logging the IP address that is polling it with the wrong community string.
If the device cannot show you what is connecting to it, you will have to setup a protocol analyser to capture the IP address of the device that is polling that host.