eventman.log: file truncated

[nfv_nagios]

Hi Support

I recently upgraded to Nagios XI 5.4.0.

I notice when i tail /usr/local/nagiosxi/var/eventman.log, i will get this "eventman.log: file truncated" message after a while. Can you advise what is causing this and is it impacting anything?


#tail -f /usr/local/nagiosxi/var/eventman.log

.....tail: eventman.log: file truncated
No log handling enabled - turning on stderr logging
Did not find 'zeroDotZero' in module SNMPv2-SMI (/usr/share/snmp/mibs/rfc4293.mib)
Did not find 'zeroDotZero' in module SNMPv2-SMI (/usr/share/snmp/mibs/DISMAN-EVENT-MIB.txt)
Did not find 'zeroDotZero' in module SNMPv2-SMI (/usr/share/snmp/mibs/DISMAN-SCHEDULE-MIB.txt)
.
PROCESSED 9 EVENTS
tail: eventman.log: file truncated
No log handling enabled - turning on stderr logging
Did not find 'zeroDotZero' in module SNMPv2-SMI (/usr/share/snmp/mibs/rfc4293.mib)
Did not find 'zeroDotZero' in module SNMPv2-SMI (/usr/share/snmp/mibs/DISMAN-EVENT-MIB.txt)
Did not find 'zeroDotZero' in module SNMPv2-SMI (/usr/share/snmp/mibs/DISMAN-SCHEDULE-MIB.txt)
.
PROCESSED 4 EVENTS

[scottwilkerson]

This log gets truncated every minute by cron when the next cron starts. This is normal.

[nfv_nagios]

Hi Support

Can you advise which cron is doing this?
I need to keep the logs for debugging purpose.

[scottwilkerson]

Hi Support

Can you advise which cron is doing this?
I need to keep the logs for debugging purpose.

The eventman.log just logs debug output while XI process events such as notifications, global event handlers, and snmp traps.

These logs older than the previous minute are generally never needed so at the top of each minute a new cron that processes the events gets kicked off and the output is redirected to this file, with >

If you look at the /etc/cron.d/nagiosxi you will see the cron jobs. If you want to keep all the logs (not recommended because they will devour your disk space) you can replace the > with >> to append to the file instead of overwrite.

[nfv_nagios]

Thanks for the support. You may close this.

[scottwilkerson]

Thanks for the support. You may close this.

Great.

Locking thread