Hot answers tagged

66

Use the -F option instead: tail -F /var/log/kern.log The -F option tells tail to track changes to the file by filename, instead of using the inode number which changes during rotation. It will also keep trying to open the file if it's not present.


39

Most likely, the log file is less than a day old and/or has been rotated within the last day and logrotate remembers the history. If you add -f it'll force a rotation if you really want to (although not 100% sure how that interacts with -d). You can look at the history, location depends on your distribution, but might be /var/lib/logrotate/status. That ...


30

The first time you run logrotate with a new log configuration it doesn't know when the last log rotation occurred. So it just writes a status line in logrotate.status to the effect that it was run today. When it subsequently runs the following day, it sees that the log is a day old and rotates it as expected. If you don't want to wait, edit ...


29

The reason that apache needs a reload is that once it's opened a file, it gets a filehandle to it, and it will keep writing to that filehandle. When you move the file, it doesn't see that, it just keeps writing to the same handle. When you do a reload, it'll open the file again and get a new handle. To avoid the reload, instead of moving the file, you can ...


29

logrotate uses crontab to work. It's scheduled work, not a daemon, so no need to reload its configuration. When the crontab executes logrotate, it will use your new config file automatically. If you need to test your config you can also execute logrotate on your own with the command: logrotate /you/config/file Or as mentioned in comments, identify the ...


24

That is probably a mistake, it is found only in one example on that tutorial. All other examples have copytruncate without the create option. Also logrotate man page says that is will be actually ignored: copytruncate Truncate the original log file to zero size in place after creating a copy, instead of moving the old log file and optionally ...


17

Most of the logrotate setups I've seen on various distros runs out of the /etc/cron.daily. There's a shell script there aptly named logrotate. Example $ ls -l /etc/cron.daily/logrotate -rwxr-xr-x 1 root root 180 May 18 2011 /etc/cron.daily/logrotate Manual run If you want to make it run manually simply run the script as root: $ sudo ...


15

Depending on your OS. Some (all?) Linux distributions have a directory /etc/cron.hourly where you can put cron jobs to be executed every hour. Others have a directory /etc/cron.d/. There you can put cron-jobs that are to be executed as any special user with the usual cron-settings of a crontab entry (and you have to specify the username). If you use either ...


10

I won't discuss logging with regard to ubuntu specifically much, since the topic is standardized for linux in general (and I believe most or all of what I have to say is also true in general for any flavor *nix, but don't take my word for that). I also won't say much about "how to read logs" beyond answering this question: Is the assumption even correct ...


9

The obvious thing to do would be to go to the logrotate home page and look around for some version history. There you can find the original 0.1 release in version control, and the manual page for that release gives the author as "Erik Troan <ewt@redhat.com>" and the date as "Mon Nov 18 1996". This took about a minute.


8

The post rotate action appears to be incorrect Try invoke-rc.d nginx reload >/dev/null 2>&1 If you look at the nginx command you will see the actions it will accept. Also the message you got says check initctl --help xtian@fujiu1404:~/tmp$ initctl help Job commands: start Start job. stop Stop ...


8

It should be automatic via cron. You can force it to test your changes. For global logrotate: sudo logrotate -v -f /etc/logrotate.conf For a single conf file: sudo logrotate -v -f /etc/logrotate.d/someapp.conf


8

Yes. You're looking for tail -F instead of tail -f (that is, a capital F instead of lowercase). Check the tail(1) manpage. Alternatively, you could use --follow=name --retry, which the man page documents as the same thing. (These are from GNU coreutils tail. Other tails may not have this; POSIX does not specify -F, --follow, or --retry. If you have to work ...


6

The logrotate option that does what you describe is copytruncate. Simply add this option to your existing logrotate config. Here is the excerpt from the logrotate.conf manual: copytruncate Truncate the original log file in place after creating a copy, instead of moving the old log file and optionally creating a new one, ...


5

The problem is that you're using the same logfile name in each of the entries. A weekly rotation happens once it's gone more than a week since the last time that log file was rotated. Since the file gets rotated each day, you'll never get to the weekly run. (You'll also never get to the montly run, for the same reason.) So, in order to keep the weekly and ...


5

Unix signal delivery is asynchronous. When the kill system call returns, the signal has been delivered to the process, but the process may not have reacted to it yet. You were lucky with the scheduler under 11.04. If the killed process has a handler for the signal, it can spend an arbitrarily long time before dying, or choose not to die as a result of the ...


5

The usual solution for this problem is to use rotate the logfiles so that the current logfile only contains current entries, rather than removing outdated entries from the file. This is all handled by the logrotate program. The following configuration should do approximately what you want. It will keep the last 6 months of log entries from ...


5

It's called logrotate because typically it is used to "rotate" logs to new files periodically -- that is, it doesn't delete or refresh them (at least from my interpretation of those words). One definition of "rotate" provided by the Random House Dictionary is: to cause to go through a cycle of changes or follow in a fixed routine of succession: to ...


5

logrotate is used by the system to rotate logs so you have 2 choices. You can either incorporate the rotation of these app logs into the systems rotations or setup your own and either run them manually or from the root user's crontab (Assuming the Rails app is run as root given it's directory is /root/...). System rotation To setup a logrotation within the ...


4

logrotate can do it with olddir if your log file name is the same every time it runs and you can add dates. If your log file name changes i.e. YYYYMMDD then logrotate won't do it for you. # sample logrotate conf file copytruncate compress dateformat %Y%m%d. dateext extension log olddir ./logarchive /logs/sys.log { rotate 7 daily } Copies and ...


4

To cut the logs Apache project has a useful command rotatelogs designed to rotate input recieved via an input pipe Read about rotatelogs Then there is also the cronolog better time handling. Cronolog website But if you are also rotating then it's worth considering logrotate, but logrotate will need a mechanism to trigger a new logfile, (send a signal, ...


4

Most modern Linux distros include a tool called logrotate which the OS then uses to maintain the /var/log directory. You can use it too. It is kicked off via cron, so if you want the logs rotated with a certain frequency then you need to setup a cronjob that runs atleast that frequently. Examples This will rotate the 2 files access.log & error.log, ...


4

On my CentOS 6.5 machine for setting up logrotatefor nginx I had to do this: logrotate /etc/logrotate.d/nginx And then I checked if logrotate taking care of my new nginx config like this: cat /var/lib/logrotate.status


4

Here's some sample log file output: Feb 26 23:04:55 pegasus internal-sftp[32524]: session opened for local user joeuser from [123.123.123.123] Feb 26 23:04:57 pegasus internal-sftp[32524]: opendir "/home/joeuser" Feb 26 23:04:58 pegasus internal-sftp[32524]: closedir "/home/joeuser" Feb 26 23:05:01 pegasus internal-sftp[32524]: opendir "/home/joeuser/" Feb ...


4

X's logging behavior is: If there is a /var/log/Xorg.DISPLAY.log, rename it to /var/log/Xorg.DISPLAY.log.old, overwriting any file that might be there. Open /var/log/Xorg.DISPLAY.log, and begin logging to it. Unfortunately, this isn't configurable, except in the sense all open-source software is: you could change the source code and recompile. It's in ...


4

I recommend you to use http://cronolog.org/ This is how I use it: CustomLog "|/usr/local/sbin/cronolog -S /var/log/httpd/t3.CCC.eu-access_log -P /var/log/httpd/t3.CCC.eu-access_log.prev /var/log/httpd/t3.CCC.eu-%Y.log" combined


3

I think your target files should have a different name for both weekly and monthly. If you look at the status file it stores target name + Date so that it knows when target was last run. It is a log rotation system not really a backup system. I would recommend a different strategy. and use something like rsnapshot which is designed to do something like ...


3

The idea is that you always have a relatively fresh main file (such as access_log or error_log) which contains the latest entries. As the log becomes either too old or too large, logrotate creates archived files so that no information is discarded (something like access_log-YYYYMMDD). Therefore, older logs can still be accessed without the main log file ...


3

Check if there are any files here: /etc/logrotate.d If so, remove whichever relate to what you don't want to rotate. But be careful on what you are removing, make sure that you have a file-cleanup method for all files that are rotated with logrotate otherwise you run the risk of waking up one day and not understanding how your filesystem ran out of ...


3

Rotating a log file is not sufficient, you have to tell the process that's writing to it to stop as well. You typically can do this by sending a signal to the process, such as a HUP. Example /var/log/snmpd.log { notifempty missingok postrotate /bin/kill -HUP `cat /var/run/snmpd.pid 2> /dev/null` 2> /dev/null || true endscript ...



Only top voted, non community-wiki answers of a minimum length are eligible