How can I flush and/or rotate cronevents?

Question

Can anyone tell me how I can flush / clean / zeroize or better still rotate the contents of cronevents?

I need to solve this, because I am attempting to 'productionize' my fileserver instance-pair which rely on some services under Cygwin (CYGWIN_NT-6.0 x86-64) with a cron job which runs every 10 minutes.

cronevents is a useful facility whilst debugging. But now I am testing whole runs over several days the cronevents takes several minutes to get to the bottom. That's after several days; so I cannot imagine that this is a usable approach to tracing steps after several years.

In terms of the implementation of cronevents, I can see that it is implemented as /bin/cronevents.exe. There is no man page, and the only advice is

$ cronevents --help
Usage: cronevents
Function: prints cron and crontab Windows event log entries on stdout.
Return value: 0 on success, 1 the if application log cannot be opened.

As you can see from the above, there seems to be a glaring lack of advice as to how to maintain the cronevents audit trail to a restricted size.

I have been unable to work out where this events file is held. Does anybody have the solution please?

Answer 1

Hi I see that this question has been visited several times. Because at time of writing there is no answer elsewhere on the internet I had better write up the workaround which I have adopted so far. My workaround has been tested by me under Cygwin 1.7.32 / cron 5.

The problem is that the operation of the cronevents call in Cygwin appears to be undocumented. But from experimentation looking at the host operating system -- Windows 2008 in this case -- the operation of croneents is to read the Windows Application Event Log file. Then it retrieves events that have been written to that log by cron and crontab.

Having discovered that is what is happening, it is clear that there actually is a limit to the size of the event log set in Windows. The problem is simply that the default size is 19.8MB. In practice you may find this is relatively large if you are trying to read through the resulting lines produced by cronevents and even tailing the last 100 lines takes longer than you might wish.

In which case you may wish to reduce the amount of retained logging, on the assumption that the host is mainly working to provide the cron payload. If desirable to reduce the retained logging, then it is possible to login to the host system and tune down the size of the Application Event Log as follows.

1. Once logged into Windows, run eventvwr which brings up a user interface screen.
2. Select the "Windows Logs" entry and double click to expand the list of these.
3. Right click on the “Application” log and choose Properties to see the file location, size, overwrite/rotation policy etc.
4. The box 'Maximum log file size (kB):' may be adjusted down as low as 1028 kB. Typing 1028 into the box and then clearing the log using the 'Clear Log' button at the bottom right of the GUI made the adjustment when I tried it.

This was a good enough fix for the cron event logging to be more manageable in my experience.

So that is the best resolution I have found so far. Obviously I should have preferred to find an answer using commands at the cygwin remote command prompt directly and would not have wished to need to login to the Windows desktop. But having configured the capacity solution via Windows it should be possible to keep the server running and concentrate on the cygwin bash side of things from that point onwards.

I think it would be useful to have been forewarned about the need to preconfigure cronevents capacity at time of setting up cygwin under Windows, so hopefully this note will save future developers some trouble figuring it out.