Solaris 10 logadm

Hi.
This is my Solaris 10 server (x86) server. There is one log rotation working for below logs -

bash-3.00# ls -lhtr /tftpboot/dcwdx1*
-rwxrwxrwx   1 root     root         55K Feb 26 16:00 /tftpboot/dcwdx1.b.9
-rwxrwxrwx   1 root     root         55K Mar  5 16:00 /tftpboot/dcwdx1.b.8
-rwxrwxrwx   1 root     root         55K Mar 13 17:00 /tftpboot/dcwdx1.b.7
-rwxrwxrwx   1 root     root         55K Mar 20 17:00 /tftpboot/dcwdx1.b.6
-rwxrwxrwx   1 root     root         55K Mar 27 17:00 /tftpboot/dcwdx1.b.5
-rwxrwxrwx   1 root     root         55K Apr  3 17:00 /tftpboot/dcwdx1.b.4
-rwxrwxrwx   1 root     root         55K Apr 10 17:00 /tftpboot/dcwdx1.b.3
-rwxrwxrwx   1 root     root         55K Apr 17 17:00 /tftpboot/dcwdx1.b.2
-rwxrwxrwx   1 root     root         55K Apr 24 17:00 /tftpboot/dcwdx1.b.1
-rwxrwxrwx   1 root     root         55K May  1 17:00 /tftpboot/dcwdx1.b.0
-rwxrwxrwx   1 root     root           0 May  2 03:10 /tftpboot/dcwdx1.b
bash-3.00#

Similarly, I want to setup for this log too -

bash-3.00# ls -lhtr /tftpboot/dcddx1*
-rwxrwxrwx   1 user1   grp1       58K May  1 17:00 /tftpboot/dcddx1.b
bash-3.00#

Ideally Solaris 10 logration works with logadm.conf, but I can't see any relevant entry, what must be rotating dcwdx1. There is just -P, which means logadm looked at this log at this time (am I correct on this ?)

I don't see anything in crontab of root too. What am I missing ? I am trying to find, how these logs are being rotated

bash-3.00# crontab -l
#ident  "@(#)root       1.21    04/03/23 SMI"
#
# The root crontab should be used to perform accounting data collection.
#
#
10 3 * * * /usr/sbin/logadm
15 3 * * 0 /usr/lib/fs/nfs/nfsfind
30 3 * * * [ -x /usr/lib/gss/gsscred_clean ] && /usr/lib/gss/gsscred_clean
#
# The rtc command is run to adjust the real time clock if and when
# daylight savings time changes.
#
1 2 * * * [ -x /usr/sbin/rtc ] && /usr/sbin/rtc -c > /dev/null 2>&1
#10 3 * * * /usr/lib/krb5/kprop_script ___slave_kdcs___
bash-3.00#
bash-3.00# cat /etc/logadm.conf | grep -v "#"
/var/cron/log -P 'Wed Apr 23 10:10:00 2025' -c -s 512k -t /var/cron/olog
/var/lp/logs/lpsched -C 2 -N -t '$file.$N'
/var/fm/fmd/errlog -M '/usr/sbin/fmadm -q rotate errlog && mv /var/fm/fmd/errlog.0- $nfile' -N -s 2m
/var/fm/fmd/fltlog -A 6m -M '/usr/sbin/fmadm -q rotate fltlog && mv /var/fm/fmd/fltlog.0- $nfile' -N -s 10m
smf_logs -C 8 -s 1m /var/svc/log/*.log
/var/adm/pacct -C 0 -N -a '/usr/lib/acct/accton pacct' -g adm -m 664 -o adm -p never
/var/log/pool/poold -N -a 'pkill -HUP poold; true' -s 512k
/var/adm/messages -C 8 -P 'Fri May  2 10:10:00 2025' -a 'kill -HUP `cat /var/run/syslog-ng.pid`' -z 0
/var/adm/xymessages -C 8 -P 'Fri May  2 10:10:00 2025' -a 'kill -HUP `cat /var/run/syslog-ng.pid`' -p 1d -z 1
/var/log/authlog -C 8 -P 'Sun Apr 27 10:10:00 2025' -a 'kill -HUP `cat /var/run/syslog-ng.pid`' -g root -m 0640 -o root -z 0
/var/log/maillog -C 8 -P 'Fri Apr  8 10:10:00 2022' -a 'kill -HUP `cat /var/run/syslog-ng.pid`' -z 0
/var/log/locallog -C 8 -P 'Tue Jun 25 10:10:00 2024' -a 'kill -HUP `cat /var/run/syslog-ng.pid`' -z 0
/var/adm/wtmpx -A 1y -P 'Fri Apr 11 10:10:00 2025' -p 1m -z 0
/var/adm/sulog -A 1y -P 'Fri Apr 11 10:10:00 2025' -g root -m 0640 -o root -p 1m -z 0
/tftpboot/daldx1.b -P 'Mon Apr 28 10:10:00 2025'
/tftpboot/iotdx1.b -P 'Wed Apr 30 10:10:00 2025'
/tftpboot/nwtdx1.b -P 'Sat Oct  1 10:10:00 2016'
/tftpboot/phxdx1.b -P 'Mon Apr 28 10:10:00 2025'
/tftpboot/phxdx2.b -P 'Mon Apr 28 10:10:00 2025'
/tftpboot/raldx1.b -P 'Mon Apr 28 10:10:00 2025'
/tftpboot/seadx1.b -P 'Thu May  1 10:10:00 2025'
/tftpboot/seadx2.b -P 'Mon Apr 28 10:10:00 2025'
/tftpboot/dcwdx1.b -P 'Fri May  2 10:10:00 2025'
bash-3.00#
bash-3.00# ls -ltr /var/spool/cron/crontabs/
total 12
-rw-------   1 root     sys          308 Mar 17  2009 sys
-rw-------   1 root     sys          190 Mar 17  2009 adm
-r--------   1 root     root         452 Mar 17  2009 lp
-r--------   1 root     sys          404 Apr  1  2010 uucp
-rw-------   1 root     sys          482 Apr  1  2010 root
-rw-------   1 root     autopcap     126 Jan  4  2013 autopcap
bash-3.00# cat /var/spool/cron/crontabs/* | grep tftpboot
bash-3.00#

Can someone give me some pointer, what am I missing here ? Is it something else, which is triggering this rotation ?

Thanks

There’s an entry for /tftpboot/dcddx1.b in /etc/logadm.conf ?

No, there is no entry for /tftpboot/dcddx1.b
I want to setup same log rotation as /tftpboot/dcwdx1*. I am not sure if this valid entry, if I want to use same syntax for /tftpboot/dcddx1.b

bash-3.00# cat /etc/logadm.conf | grep tft
/tftpboot/daldx1.b -P 'Mon Apr 28 10:10:00 2025'
/tftpboot/iotdx1.b -P 'Wed Apr 30 10:10:00 2025'
/tftpboot/nwtdx1.b -P 'Sat Oct  1 10:10:00 2016'
/tftpboot/phxdx1.b -P 'Mon Apr 28 10:10:00 2025'
/tftpboot/phxdx2.b -P 'Mon Apr 28 10:10:00 2025'
/tftpboot/raldx1.b -P 'Mon Apr 28 10:10:00 2025'
/tftpboot/seadx1.b -P 'Thu May  1 10:10:00 2025'
/tftpboot/seadx2.b -P 'Mon Apr 28 10:10:00 2025'
/tftpboot/dcwdx1.b -P 'Fri May  2 10:10:00 2025'
bash-3.00#

Thanks, that helps clears things up.

If you want to match the same rotation behavior as /tftpboot/dcwdx1.b, you can use the same pattern with this logadm command:

logadm -w /tftpboot/dcddx1.b -P now

I thought same, but -P means "previous" rotation time, i.e., the timestamp of the last rotation or when the file was last processed. I am not seeing configuration/line which would rotate these logs. This is where I was getting confused, if just putting same line will put these logs in rotation ?

The -P timestamp is updated by each logadm run.
If you just put /tftpboot/dcddx1.b without a schedule then logadm will rotate it with a default schedule (the man page says –s 1b –p 1w).
If you don't give a -C n for n rotations then it's the default (-C 10)
If you don't give it a -a xxx action then it's the default (no action).

I have always liked the simplicity of logadm, in contrast to the overloaded Linux logrotate.

If you want to be explicit and avoid future confusion from default behaviors, etc, consider:

logadm -w /tftpboot/dcddx1.b -p 1w -C 10 -t '$file.$n' -z 0 -P now

That makes the rotation behavior clear in logadm.conf.

Is the default for -C 10 or is it 4?

The man page:

By default, ten versions of old log files are kept (that is, logfile.0 through logfile.9).

If none of these options are specified, the default expiration s -C 10 which keeps ten old log files. If no files are to be expired, use -C 0 to prevent expiration by default.

Also the o/p here shows 10 rotated /tftpboot/dcwdx1.b files, and no options in logadm.conf.

BTW the man page mentions -p now not -P now. And, if you omit it, the next run of logadm (crontab) will rotate.

Thanks for catching that.

–p period
Rotate a log file after the specified time period (period ).

Specify period as a number followed by d for days, h for hours, w for weeks, m for months (30 days) or y for years. There are also two special values for period: now and never. “–p now” forces log rotation. “–p never” forces no log rotation.

–P timestamp
Used by logadm to record the last time the log was rotated in /var/logadm/timestamps.

This option uses timestamp to determine if the log rotation period has passed. The format of timestamp matches the format generated by ctime(3C), with quotes around it to protect embedded spaces. timestamp is always recorded in the Coordinated Universal Time (UTC) time zone.

Reference:

Thank you. This really helps.