Console logs

The system has a set of scripts that will run automatically late at night and take care of rotating the console and system logs, meaning that the files would be closed and renamed, with new logfiles starting up at zero. They are found in /etc and are named, appropiately enough, daily, weekly and monthly, reflecting how often they will run if allowed to do so. Since this is set to occur late at night, in most cases they are never executed.

I use the [Onyx|http://www.titanium.free.fr/pgs/english.html] freeware utility to execute them manually, as well as to purge unneeded logs. There are other maintenance tools, free or shareware, that can do likewise.

Volsav wrote:
How would I find "/etc"?

If you are comfortable using Unix commands, using Terminal you can go into the /etc system directory ( +cd /etc+ ). If not, better access the scripts using Onyx commands.

I have Onyx. I used the cleaning button, Log tap. I pressed execute to delete the log files, but the system.log still has entries. Can you determine if I am missing some step in the process?

Clicking the Maintenance icon, to the left of Cleaning, you will find the Scripts tab. There you can either run the scripts manually or reschedule them to a more adequate moment. By default, daily runs every day at 3:15 AM, weekly runs on Saturdays at 3:15 AM and monthly runs on the first of every month at 5:30 AM, if the computer is turned on. More info on what each script does can be found by clicking on the question mark button on the Scripts pane.

To clean out the logs, run the scripts first, then do the Clean option, so the rotated logs get eliminated. The current logs won't normally be erased since they are being added to.

Volsav wrote:
I am not familiar with Unix commands and using Terminal. However, I was familiar with DOS back in the day. Just to experiment, I tried to go into the "/etc" system directory using "cd /etc" but did not get anywhere. I assume I just am not going about it in the right way.

You did, except you didn't know it. In command-line mode, you will not get any visual feedback; it just gets done. Only if something went wrong would you get a message. For example, when you opened Terminal, the Unix shell (command line interpreter) started up in your home directory but when you typed *cd /etc*, it changed over to the /etc directory. You can check where you are with the pwd command ( p rint w orking d irectory). When in /etc, if you type the ls command ( l i s t), you would get a list of all the files and subdirectories found there, amongst which you would have seen daily, weekly and monthly, the maintenance scripts in question.

DOS looks kinda Unix-ish, cause when Bill Gates and his cohorts got the contract to write an operating system for the first IBM PC, the only one they knew was Unix, which they had learned in their brief stint in college. So, they ripped the ideas (surprise, surprise...) and came out with a sort of emasculated Unix; looks like the original, but without the important and useful parts... 😉 And we know he would drop out of college, go on to become a gazillionare and only recently did he "finish" school and get his degree, but I'm digressing.

What is the difference between a "rotated log" and a "current log?"

Any current log is just a textfile that is being written to by a process. Most applications defer all logging details to a general logging process called syslog, which is standard in Unix; they send the messages to syslog and it takes care of everything else. To be able to write to it, the logfile must be opened by the writing process and while it is open, no other process can change it.

When you rotate a logfile, the maintenance script tells the writing process to close the logfile, it gets renamed to something else, and the writing process creates and opens a new logfile. The maintenance script also takes care of compressing the old renamed logfile so it takes up less room, but keeps it around just in case it is needed later. It also numbers the old logfiles and keeps a limited number of them; that's why if you do an *ls /var/log* in Terminal after running the maintenance scripts and before doing the cleaning, you may see a number of files named xxx.log.1.gz, xxx.log.2.gz, etc. The highest numbered one is the oldest of the bunch (do an *ls -l /var/log* instead, for more info).

What is the "DirectoryService.error.log"

DirectoryService is the application that MacOS X uses to authenticate users logging in or requesting more privileges (like when Onyx asks for your password). The equivalent of Windows Active Directory or, in Unix, LDAP or NISplus. That logfile contains any authentication errors encountered. DirectoryService also keeps another log: DirectoryService.system.log. Both are found inside /Library/Logs/DirectoryService and can be viewed (as can all other logs) using the Console application found in Utilities. Just use the File>New Log Window menu item and scroll to find it.

What are the logs listed under "/var/log"? Can the entries that are still in these logs after running the scripts you described and the Clean option be deleted?

Various other logs created by or at the behest of other processes or applications. MacOS keeps logfiles in /var/log/, /Library/Logs/ and in the Library/Logs/ subdirectory in your home directory, as you will find out if you use the New Log Window menu item in Console as mentioned above. Only rotated logs can be safely erased, since the others will probably be open.

What are the logs that I do not have access to, i.e. "mb.log" and "secure.log"? PS, I am the system administrator.

Those logs belong to the root user, not you, and have restrictive access permissions. If you want to see what's inside secure.log, you can try the following command in Terminal: *sudo more /var/log/secure.log* You will be prompted for your password and the contents of the logfile will be shown a screenful at a time, type a space to scroll to the next screenful or q to quit.

Besides all the many Unix books available, some specific to MacOS X, you may find the [Clix application|http://rixstep.com/4/0/clix> useful for exploring the various Unix commands available.