Hot answers tagged logrotate
18
I suppose you are searching for:
tail -F /var/log/kern.log
The -F option tells tail to track changes to the file by filename, instead of using the. inode number which changes during rotation. It will also keep trying to open the file if it's not present.
9
Most likely, the log file is less than a day old and/or has been rotated within the last day and logrotate remembers the history.
If you add -f it'll force a rotation if you really want to (although not 100% sure how that interacts with -d).
You can look at the history, location depends on your distribution, but might be /var/lib/logrotate/status. That ...
7
The reason that apache needs a reload is that once it's opened a file, it gets a filehandle to it, and it will keep writing to that filehandle. When you move the file, it doesn't see that, it just keeps writing to the same handle. When you do a reload, it'll open the file again and get a new handle.
To avoid the reload, instead of moving the file, you can ...
3
I won't discuss logging with regard to ubuntu specifically much, since the topic is standardized for linux in general (and I believe most or all of what I have to say is also true in general for any flavor *nix, but don't take my word for that). I also won't say much about "how to read logs" beyond answering this question:
Is the assumption even correct ...
3
I recommend you to use http://cronolog.org/
This is how I use it:
CustomLog "|/usr/local/sbin/cronolog -S /var/log/httpd/t3.CCC.eu-access_log -P /var/log/httpd/t3.CCC.eu-access_log.prev /var/log/httpd/t3.CCC.eu-%Y.log" combined
3
That is probably a mistake, it is found only in one example on that tutorial. All other examples have copytruncate without the create option. Also logrotate man page says that is will be actually ignored:
copytruncate
Truncate the original log file to zero size in place after creating a copy, instead of moving the old log file and optionally ...
3
Please tell us more about your requirements - it's hard to guess what limits your server:
disk i/o? You might want to spread out those logfiles over disks/filesystems
cpu - is it compressing those logs as they are rotated? You might want to use a filesystem with internal compression, and even hardware acceleration.
directory cache? see the answer by Chris ...
3
Depending on your OS. Some (all?) Linux distributions have a directory /etc/cron.hourly where you can put cron jobs to be executed every hour.
Others have a directory /etc/cron.d/. There you can put cron-jobs that are to be executed as any special user with the usual cron-settings of a crontab entry (and you have to specify the username).
If you use either ...
3
You could write a little bash script to do this. Just tail the file to a certain byte count using tail -c and overwrite the file.
from man tail:
-c, --bytes=N
output the last N bytes; alternatively, use +N to output bytes
starting with the Nth of each file
If the first character of N (the number of bytes or lines) is a ...
2
I think tmpwatch or tmpreaper might do what you need. Both are already in the respective distros.
# CentOS
yum install tmpwatch
# Debian/Ubuntu
aptitidue install tmpreaper
2
From man logrotate:
copytruncate
Truncate the original log file to zero size in place after creat‐
ing a copy, instead of moving the old log file and optionally
creating a new one. It can be used when some program cannot be
told to close its logfile and thus might continue writing
...
2
Here's a quickie script which will do what you need:
#!/bin/bash
LOGDIR=/var/log/somedir
OLDLOGS=/var/log/keep-old-logs-here
PATH=/bin:$PATH
TODAY=$(date +'%Y%m%d')
[ -d $OLDLOGS ] || mkdir -p $OLDLOGS
cd $LOGDIR
for LOG in $(ls | egrep '^[[:digit:]]{8}$'); do
[ $LOG -lt $TODAY ] && gzip $LOG && mv $LOG.gz
done
Make the script ...
1
It seems like you're new to FreeBSD, and coming from a Linux background.
Let's clear a few things up --
First, newsyslog isn't a package -- it's a program that comes with the base FreeBSD operating system. You shouldn't have to install it, and it should always be there.
If /usr/sbin/newsyslog is missing from your system someone has deleted it (for reasons ...
1
It's executed three times, once for each matching file. There's a hint in the man page:
sharedscripts
Normally, prerotate and postrotate scripts are run for each log which is rotated and the absolute path
to the log file is passed as first argument to the script. That means a single script may be run multi-
ple times for log file ...
1
The logrotate status file is used to keep track of when a daily log was last rotated. It seems to be willing to write a bogus date like 1970, or 1907 in the case of one embedded system of mine. However when it is next run, it rejects the date in it's own status file and doesn't rotate logs.
I've worked around this by just deleting the status file. This ...
1
Removing old logs is the main job of logrotate. The number of old log versions kept on your disk is set by the rotate config option.
Also, take a look at the configuration files (/etc/logrotate.conf and /etc/logrotate.d/*) as well as man logrotate to see various ways how the rotation can be triggered (like monthly or by size limit).
1
If you have nosharedscripts set (the default), and the prerotate script exits with an error the affected log file will not have any further action taken on it*.
So, in theory, you could have something like (warning, untested):
/var/log/application.log {
nosharedscripts
prerotate
logfile=$1
lsof $logfile >/dev/null
exit $?
...
1
In the interest of keeping things simple, I'd run a daily cron job that concatenates yesterday's log files into one file (e.g. yesterday.log) and on success deletes them, and then run logrotate to (re)name and compress that file. You might be able to coerce logrotate into doing the whole task using sharedscripts but I don't think so and I wouldn't waste ...
1
There's quite a mess in your permissions in /var/log/munin and in your config file. You have different user/group pair for your files and diffrent group/pair in your configuration.
You have 2 choices in order to solve your problem
Use default root:root permissions
Specify in ALL your munin rules the same user/group pair
First, you can reset ...
1
If you had no logs at all in a certain time period, then possibly your root partition was full at the time. Unless you've kept historical data about your filesystems, it can be next to impossible to make sure that was the problem if whoever deleted some large files didn't realize he was doing it.
Protecting against overflowing logs is difficult. Having a ...
1
logrotate can do it with olddir if your log file name is the same every time it runs and you can add dates. If your log file name changes i.e. YYYYMMDD then logrotate won't do it for you.
# sample logrotate conf file
copytruncate
compress
dateformat %Y%m%d.
dateext
extension log
olddir ./logarchive
/logs/sys.log {
rotate 7
daily
}
Copies and ...
Only top voted, non community-wiki answers of a minimum length are eligible
