Critical System Message about SNMP Log

[Iglu_]

Hi everybody.

I have this messages in the log and i cannot figure out which log that has to be cleared!

<SYS20704 2010-01-13 16:20:08 - vw240200 - [127.0.0.1] System()[] - Sending iveLogNearlyFull SNMP trap to 10.10.1.10:162

Any ideas?

regards IGLU

[MattS_]

Hi,

Do you have a copy of the SNMP trap as recieved by the SNMP server 10.10.1.10?

The MIB definition for this trap is:

iveLogNearlyFull NOTIFICATION-TYPE     OBJECTS { logFullPercent, logName }     STATUS    current     DESCRIPTION     "Log file nearly full"     ::= { iveTraps 4 }

So I would expect the sent trap message to include the logName Object which is either admin, user or event, along with the percentage used:

logName OBJECT-TYPE     SYNTAX      OCTET STRING     MAX-ACCESS  accessible-for-notify     STATUS      current     DESCRIPTION         "Name of the log (admin/user/event)"     ::= { juniper-ive 23 }

logFullPercent OBJECT-TYPE     SYNTAX    Gauge32     MAX-ACCESS    read-only     STATUS    current     DESCRIPTION       "Percentage of log file full"     ::= { juniper-ive 1 } 

[lukeprimm_]

Ive also started getting these repeatedly and I cant find a solution. Is there a quick fix? Thanks

2011/03/07 10:03:02 - secure2 - System()[] - Sending iveLogNearlyFull SNMP trap to 10.0.0.127:162

[RKB_]

1) Try clearing the user access/ event /admin log (after taking a backup).

2) Delete any system / admin generated snapshots from troubleshooting -> system snapshot page. (after taking a backup)

3) Check the SNMP trap thresholds that has been set under log /monitoring -> SNMP to check what percentage of log frequency is set. May want to increase it if its too low.

[htroberts_]

> Try clearing the user access/ event /admin log (after taking a backup)

Is there not an option for automatic log rotation/maintenance? Or to allow the oldest messages to merely fall off?

If a system generating messages runs long enough, it will eventually fill up any log space. Why would anyone make managing those messages a manual process?

[zanyterp_]

htroberts wrote:

> Try clearing the user access/ event /admin log (after taking a backup)

Is there not an option for automatic log rotation/maintenance? Or to allow the oldest messages to merely fall off?

If a system generating messages runs long enough, it will eventually fill up any log space. Why would anyone make managing those messages a manual process?

---

Automatic archiving can be configured, yes. It is done at Maintenance>Archiving.

You can define the frequency of backup as well as if you want to have the log cleared once the archive completes.

For the original message, it is not any specific log but on the whole how much is being logged across all 4 system logs.

[rswinter_]

reviving old thread..... Similiar problem... 

We only started seeing the alerts since I enabled SNMP Traps, so either it's just a coincidense (the boxes have been running for years and we've never maunally cleared the logs, so that's highly unlikely) or the act of enabling the SNMP Traps started the monitoring.

It's the UserLog that is giving us the warning....  If the old logs just fall off when a new one needs the space, then I will just set the warning to 100% (or 0% if that disabled it). I just want to make sure that it will not stop recording new logs if it really gets full....

I saw the "Archive" logs part, but I don't want to archinve them on some server somewhere, I just want the old ones deleted.  We send everything to our syslog server anyway, so we have what we need for historical purposes...

Thanks.

-Stephen

[zanyterp_]

Enabling traps starts the monitoring for messages to be sent, yes.
There is no auto-delete option or mechanism to remove old logs without archiving.
Once it is full, the logs continue to be recorded and overwrite the old messages