000034421 - How to rotate the consoleserver-error.log file to prevent it from becoming too large in RSA ECAT 4.x

Document created by RSA Customer Support Employee on Nov 29, 2016Last modified by RSA Customer Support Employee on Apr 21, 2017
Version 5Show Document
  • View in full screen mode

Article Content

Article Number000034421
Applies ToRSA Product Set:  NetWitness Endpoint, ECAT
RSA Product/Service Type: ECAT Console Server
RSA Version/Condition: 4.1.x.x, 4.2.x.x
IssueThe consoleserver-error.log file continues to grow until the disk space is exhausted.
TasksThe log file can be rotated by creating a batch file and running it as a scheduled task. This batch file will keep any rotated log files for 30 days. The batch file should be saved in location c:\batch\RotateLog.bat
This batch file only works with UK formatted time:
rem Batch File to Rotate Ecat consoleserver-error.log
rem Run as a scheduled task
rem Taken from a similar idea at https://communities.bmc.com/docs/DOC-32941
rem Time Stamp taken from http://stackoverflow.com/questions/203090/how-to-get-current-datetime-on-windows-command-line-in-a-suitable-format-for-us/19799236#19799236

@echo off
pushd "%temp%"
makecab /D RptFileName=~.rpt /D InfFileName=~.inf /f nul >nul
for /f "tokens=3-7" %%a in ('find /i "makecab"^<~.rpt') do (
   set "current-date=%%e-%%b-%%c"
   set "current-time=%%d"
   set "weekday=%%a"
   for /f "tokens=1-3 delims=:." %%a in ("%current-time%") do set hours=%%a&set minutes=%%b&set seconds=%%c
del ~.*
echo %current-date%_%hours%-%minutes%-%seconds%
cd "C:\Program Files\RSA\ECAT\Server"
sc stop  RSAECATServer
timeout 60
move consoleserver-error.log consoleserver-error_%current-date%_%hours%-%minutes%-%seconds%.log
sc start RSAECATServer 
rem Delete Log Files that older than 30 days
forfiles -p "C:\Program Files\RSA\ECAT\Server" -s -m consoleserver-error*.log -d -30 -c "cmd /c del @path"

Run this batch file as a scheduled task to run as a scheduled task.
schtasks /delete /f /TN RotateECATLog
schtasks /create /TN RotateECATLog /SC DAILY /ST 04:15 /RU "System" /TR "\"C:\batch\RotateLog.bat"" /F