Installation guide

13.3 Recovering Event Logs After a System Crash
You can recover unprocessed messages and binary event-log records from a
system crash when you reboot the system.
The msgbuf.err entry in the /etc/syslog.conf file specifies the
destination of the kernel syslog message buffer msgbuf that is recovered
from the dump file. The default /etc/syslog.conf file entry for the
kernel syslog message buffer file is as follows:
msgbuf.err /var/adm/crash/msgbuf.savecore
The dumpfile entry in the /etc/binlog.conf file specifies the file name
destination for the kernel binary event-log buffer that is recovered from the
dump file. The default /etc/binlog.conf file entry for the kernel binary
event-log buffer file is as follows:
dumpfile /usr/adm/crash/binlogdumpfile
If a crash occurs, the syslogd and binlogd daemons cannot read the
/dev/klog and /dev/kbinlog special files and process the messages and
binary event records. When you reboot the system, the savecore command
runs and, if a dump file exists, recovers the kernel syslog message and
binary event-log buffers from the dump file. After savecore runs, the
syslogd and binlogd daemons are started.
The syslogd daemon reads the syslog message buffer file, checks that its
data is valid, and then processes it in the same way that it normally
processes data from the /dev/klog file, using the information in the
/etc/syslog.conf file.
The binlogd daemon reads the binary event-log buffer file, checks that its
data is valid, and then processes the file in the same way that it processes
data from the /dev/kbinlog special file, using the information in the
/etc/binlog.conf file.
After the syslogd and binlogd daemons are finished with the buffer files,
the files are deleted.
13.4 Maintaining Log Files
If you specify full pathnames for the message destinations in the
/etc/syslog.conf and /etc/binlog.conf files, the log files will grow
in size. Also, if you configure the syslogd daemon to create daily
directories and log files, eventually there will be many directories and files,
although the files themselves will be small. Therefore, you must keep track
of the size and the number of log files and daily directories and delete files
and directories if they become unwieldy.
Administering Events and Errors 13–13