logadm(8)

NAME

logadm - rotate OmniCube and system logs, wrapping the system logadm

SYNOPSIS

/opt/omnicube/sbin/logadm

DESCRIPTION

This page describes /opt/omnicube/sbin/logadm, the OmniCube log-rotation wrapper. It is not the system log-rotation command: the wrapper is a short /bin/sh script whose only job is to invoke /usr/sbin/logadm, first for the system-wide configuration and then once for every drop-in configuration file under /etc/logadm.d. All rotation policy lives in those configuration files and all rotation work is done by the system command; the wrapper adds only a run-level guard and the privilege escalation.

It runs, in order:

1.: Unless OC_IGNORE_RUNLEVEL is set to a non-empty value, it extracts the current run level as the field following the run-level token in the output of who -r, and exits 0 silently when that level is 0, 1, 5, 6, S or s, that is when the host is halting, rebooting, shutting down or in single-user mode. It also exits 0 when /etc/nologin exists. Rotating logs while the host is going down would only leave half-renamed files behind. This guard is open-coded because the wrapper is a /bin/sh script and does not source /opt/omnicube/lib/common/utils.sh; the same who -r parse works on illumos and on Linux.
2.: Runs pfexec logadm with no arguments, which processes the default configuration, /etc/logadm.conf.
3.: Iterates over /etc/logadm.d/*.conf, skipping anything that is not a regular file, and runs pfexec logadm -f file for each one, so that every drop-in is processed as its own configuration file.

The wrapper sets PATH to /usr/sbin:/sbin:/usr/bin before doing any of this, which is also what keeps logadm inside the script resolving to /usr/sbin/logadm and not back to the wrapper itself.

It takes no options and passes none through; it is meant to be run periodically from a root or operator crontab entry, or by hand after changing a drop-in configuration. There is no locking, so two concurrent runs would ask the system command to rotate the same files twice.

OmniCube drop-in configuration

The suite ships one drop-in, /etc/logadm.d/omnicube.conf, containing three entries:

omnicube -C 8 -a '/usr/sbin/svcadm restart rsyslog' \\
    -g sys -m 640 -p 1w -s 10m '/var/log/{misc,auth}.log'

Read against logadm.conf(5): the entry is named omnicube; -C 8 keeps eight old versions; -a runs svcadm restart rsyslog after a rotation, so the daemon reopens its files; -g sys and -m 640 set group and mode on the rotated files; -p 1w asks for at most one rotation a week; and -s 10m suppresses the rotation unless the file has reached 10 MB. The log files themselves are the OmniCube-relevant part of /var/log, where the suite's info(), warning() and error() output ends up by way of syslog.

The second and third entries rotate the socat logs written by activate_zone_vnc.sh(1), which live at <zonepath>/log/vnc.log amp;. Two patterns are needed because both zonepath layouts are valid - /zones/zone and the OmniCube standard /zones/zone/root - and a logadm pattern is csh-style filename substitution, in which * does not cross a /:

omnicube_vnc      -N -c -C 4 -o root -m 600 \\
    -p 1w -s 10m '/zones/*/log/vnc.log'
omnicube_vnc_root -N -c -C 4 -o root -m 600 \\
    -p 1w -s 10m '/zones/*/root/log/vnc.log'

-c is required rather than preferred here: socat opens its log file once and holds it for the life of the relay, so the default rename-and-create rotation would leave every running relay writing into the rotated inode and the new vnc.log permanently empty. Copy-and-truncate keeps the open file descriptor valid. -N suppresses the "no such file" error on a node where no relay is running, and on whichever of the two patterns does not match the local layout, since the glob then expands to nothing. The files are mode 600 root because they sit inside a zonepath and can carry connection metadata for a console relay.

Because both -p and -s are present, a log smaller than 10 MB is not rotated at all, however old it is; adjust the drop-in rather than the wrapper if that is not the policy you want. Additional .conf files placed in the same directory are picked up automatically on the next run.

OPERANDS

This command takes no options and no operands. Anything on the command line is ignored. To pass options to the system command, invoke /usr/sbin/logadm directly.

USAGE

Example 1: rotate now

/opt/omnicube/sbin/logadm

Example 2: rotate from cron, twice a day

A crontab entry such as:

0 3,15 * * * /opt/omnicube/sbin/logadm >/dev/null 2>&1

Example 3: rotate during a maintenance window

The run-level guard makes the wrapper a no-op in single-user mode; override it only when you really do want rotation there:

OC_IGNORE_RUNLEVEL=1 /opt/omnicube/sbin/logadm

Example 4: see what the drop-in would do, without rotating

Dry-run support belongs to the system command, so ask it directly:

pfexec logadm -n -v -f /etc/logadm.d/omnicube.conf

EXIT STATUS

0: Either the run-level guard suppressed the run, or the last drop-in was processed successfully.
other: The wrapper returns the status of the last pfexec logadm -f it ran, so a failure in a drop-in other than the last one is not visible in the exit status.

FILES

/opt/omnicube/sbin/logadm: This wrapper.
/usr/sbin/logadm: The system log-rotation command that performs all the work.
/etc/logadm.conf: Default configuration, processed by the first, argument-less invocation.
/etc/logadm.d/*.conf: Drop-in configurations, each processed with -f.
/etc/logadm.d/omnicube.conf: The drop-in shipped with the suite, described above.
/etc/nologin: When present, the wrapper exits 0 without rotating anything.
/etc/security/exec_attr.d/omnicube: Grants the OmniCube Administration profile uid=0 execution of /usr/sbin/logadm.

ENVIRONMENT

OC_IGNORE_RUNLEVEL: When set to any non-empty value, skips the run-level and /etc/nologin checks entirely. Intended for maintenance work and for testing; the rest of the suite honours the same variable.
PATH: Ignored on entry and reset to /usr/sbin:/sbin:/usr/bin by the wrapper.

SECURITY

Rotation renames and recreates root-owned files under /var/log and updates the timestamp state that logadm keeps for its -p handling, so both invocations go through pfexec. The required uid=0 entry for /usr/sbin/logadm is part of the root-equivalent OmniCube Administration profile. Note that a drop-in configuration can carry a -a command, which logadm then runs with those privileges: the shipped entry restarts rsyslog. Treat /etc/logadm.d as a root-writable-only directory for that reason.

NOTES

The wrapper deliberately shares its name with the system command. If /opt/omnicube/sbin appears in an operator's PATH before /usr/sbin, typing logadm runs the wrapper and any options given are silently ignored, since the wrapper parses none. Use the absolute path when you mean one specific one of the two.

The default configuration is processed unconditionally, so this wrapper also performs the host's ordinary log rotation. On a host where the system logadm already runs from its own schedule, the two will contend for the same timestamp state; pick one scheduler.