[cisco-voip] Delete Log Files

Wed Sep 24 11:47:09 EDT 2014

+1 on what Daniel said.

Scheduled trace collection with delete is the only way I can currently think of to do this out of the box. Some files, like install logs have long term value, not sure what your retention options are for those?

* It is possible to automate an ssh/CLI login and file manipulation, but the CLI find/delete doesn’t allow identification by data AFAIK
* We have long requested CSCsi21579    allow scheduling commands  but still waiting. Maybe hit up your account team on this one.
* Setting a reduced number of files or file size will not guarantee < 7 days. That is always dependent on system utilization, traces configured, and the amount of tracing generated by the features used.
* RTMT serviceability API’s, which do file retrieval and delete, are now public: https://developer.cisco.com/site/collaboration/management/uc-manager-serviceability/develop-and-test/documentation/latest-version/ . Retrieval includes delete option for RTMT. I don’t see it in the API, checking into that.

-Wes

On Sep 24, 2014, at 9:24 AM, Daniel Pagan <dpagan at fidelus.com<mailto:dpagan at fidelus.com>> wrote:

If you absolutely can’t have any log files older than seven days on disk, one option would be to configure and schedule trace archiving for all services and applications, but make sure the “delete log files from the server” option is enabled.

This would provide you with two things:

1.       Log files collected off CUCM will be deleted permanently. This won’t only include CCM but other services and applications as well such as CTI Mgr, LBM, Tomcat Security, syslogs, etc.

2.       The log files you archive to a separate disk and, more importantly, the length of time they’re stored on disk, can be managed on the archive server via the example provided by Wes below (if a *nix OS) or the forfiles command I mentioned in a previous email (if a Windows OS).

Keep in mind this has the potential to put the customer into a situation where reported issues might go nowhere due to missing trace information since only seven days are retained. I’d also keep in mind the disk space required on your trace archiving server and overhead placed on CUCM –  older version of CUCM don’t automatically zip trace files on disk and, depending on specs, gzip can and has contributed to higher-than-expected CPU utilization. It will likely also include a very large number of log files needing to be transferred over FTP or SFTP, so there’s that to consider as well. You can minimize these two factors by scheduling it to occur once a day and during an after-hours window while avoiding an overlap of any backup jobs. You can also try to avoid large LDAP sync jobs or the 3:15 AM garbage collection task but it’s probably unnecessary.

I personally have never seen or configured CUCM trace and log archiving that encompassed so many services so I can’t really recommend it or speak from experience, but it, in theory, would most certainly accomplish the goal of managing the duration of all CUCM log files on disk, not just CCM SDI/SDL.

Hope this helps

- Dan

From: cisco-voip [mailto:cisco-voip-bounces at puck.nether.net] On Behalf Of Martin Schmuker
Sent: Tuesday, September 23, 2014 5:15 PM
To: Wes Sisk (wsisk)
Cc: Cisco VoIP Mailing List
Subject: Re: [cisco-voip] Delete Log Files

Guys, thank you very much for your answers.

Sorry that I did not explain, why we want to delete old files. The reason is stupid German law regarding protection of privacy. Customer asks to delete files after of 7 days. In this case it’s not really a law, but client feels better :-(

From: Wes Sisk (wsisk) [mailto:wsisk at cisco.com]
Sent: Tuesday, September 23, 2014 5:04 PM
To: Martin Schmuker
Cc: Cisco VoIP Mailing List
Subject: Re: [cisco-voip] Delete Log Files

onbox logging is circular. It will consume as much space as allocated and then loop over that. If something goes awry then Log Partition Manager (LPM) will auto-delete files as necessary.

For Scheduled Trace Collection, http://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/service/8_6_1/rtmt/rtmt/rttlc.html#wp1048184

No, there is nothing built into CUCM to manage the consumed disk space on the trace archive server. If using a *nix box a cron’d ‘find’ command does pretty well.

some possible examples:
# find files modified in the last 1 day
find . -type f -mtime -1d

-1d "within 1 day" -mtime n[smhdw]

-Wes

On Sep 23, 2014, at 6:13 AM, Martin Schmuker <ms at bilobit.com<mailto:ms at bilobit.com>> wrote:

Guys,

is there any way to delete CUCM log files (aka traces) after x days?

Thanks,  Martin
_______________________________________________
cisco-voip mailing list
cisco-voip at puck.nether.net<mailto:cisco-voip at puck.nether.net>
https://puck.nether.net/mailman/listinfo/cisco-voip

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://puck.nether.net/pipermail/cisco-voip/attachments/20140924/6bea4da1/attachment.html>