Reading the AIX error log with errpt and feeding it into syslog

What it is

errpt reads AIX's binary error log, AIX's default hardware and software error-logging facility, which records failures locally for detection and correction. Unlike syslog, it is populated by the kernel and by system components through the error-logging subsystem, not by processes writing lines of text, and it starts very early in boot — in phase 3 (the brc entry /sbin/rc.boot 3 near the top of /etc/inittab), well before rc.tcpip brings up networking and, with it, syslogd. That timing is why errpt can capture boot-time hardware failures that a network-dependent syslog server would miss.

errpt alone lists a one-line-per-event summary; errpt -a gives the full detail for each entry, and a filter such as -N hdisk0 (resource) or -d H (error class) narrows the report. errclear (as root) removes entries by error class and age, for example clearing "S" (software) and "O" (operator/errlogger) class entries older than 30 days, or "H" (hardware) entries older than 90.

Why it matters

Treating errpt as optional because "the application already logs to syslog" misses failures the application layer cannot see: disk, adapter and firmware events land only in errpt unless explicitly forwarded. Conversely, never truncate the error log file directly (for example with cp /dev/null) — doing so disables the error-logging function outright rather than just clearing entries, and IBM notes that a zero-length errlog file then has to be replaced. Trim it with errclear; to empty it completely, stop the daemon (/usr/lib/errstop), move /var/adm/ras/errlog away and restart /usr/lib/errdemon — all history is lost.

How to apply

• Review recent events: errpt for a summary, errpt -a for full detail on a specific entry.
• Schedule retention instead of ad-hoc clearing: a cron entry such as errclear -d S,O 30 and a separate one for errclear -d H 90 keeps the log from growing unbounded while retaining recent hardware evidence longer.
• To mirror events into syslog, add an Error Notification object (an errnotify stanza loaded with odmadd as root, persistent via en_persistenceflg = 1) whose en_method invokes logger, rather than trying to tail the binary error log directly.
• For other AIX logs outside errpt (daemon and application messages), configure /etc/syslog.conf as on any Unix syslog implementation, remembering it starts later in boot than error logging.

Pitfalls

• Clearing the error log with a file-truncation command instead of errclear, which disables error logging until the errlog file is replaced.
• Expecting syslog alone to capture pre-network boot failures that only errpt sees.
• Grepping the one-line summary instead of using errpt's own filters (-d, -T, -N, -s/-e for a time range) and reading errpt -a for the entries that matter.