Hot answers tagged

70

Use the -F option instead: tail -F /var/log/kern.log The -F option tells tail to track changes to the file by filename, instead of using the inode number which changes during rotation. It will also keep trying to open the file if it's not present.


41

Most likely, the log file is less than a day old and/or has been rotated within the last day and logrotate remembers the history. If you add -f it'll force a rotation if you really want to (although not 100% sure how that interacts with -d). You can look at the history, location depends on your distribution, but might be /var/lib/logrotate/status. That ...


38

logrotate uses crontab to work. It's scheduled work, not a daemon, so no need to reload its configuration. When the crontab executes logrotate, it will use your new config file automatically. If you need to test your config you can also execute logrotate on your own with the command: logrotate /etc/logrotate.d/your-logrotate-config Or as mentioned in ...


31

The first time you run logrotate with a new log configuration it doesn't know when the last log rotation occurred. So it just writes a status line in logrotate.status to the effect that it was run today. When it subsequently runs the following day, it sees that the log is a day old and rotates it as expected. If you don't want to wait, edit logrotate....


30

The reason that apache needs a reload is that once it's opened a file, it gets a filehandle to it, and it will keep writing to that filehandle. When you move the file, it doesn't see that, it just keeps writing to the same handle. When you do a reload, it'll open the file again and get a new handle. To avoid the reload, instead of moving the file, you can ...


27

That is probably a mistake, it is found only in one example on that tutorial. All other examples have copytruncate without the create option. Also logrotate man page says that is will be actually ignored: copytruncate Truncate the original log file to zero size in place after creating a copy, instead of moving the old log file and optionally ...


18

Most of the logrotate setups I've seen on various distros runs out of the /etc/cron.daily. There's a shell script there aptly named logrotate. Example $ ls -l /etc/cron.daily/logrotate -rwxr-xr-x 1 root root 180 May 18 2011 /etc/cron.daily/logrotate Manual run If you want to make it run manually simply run the script as root: $ sudo /etc/cron.daily/...


15

Depending on your OS. Some (all?) Linux distributions have a directory /etc/cron.hourly where you can put cron jobs to be executed every hour. Others have a directory /etc/cron.d/. There you can put cron-jobs that are to be executed as any special user with the usual cron-settings of a crontab entry (and you have to specify the username). If you use either ...


11

I won't discuss logging with regard to ubuntu specifically much, since the topic is standardized for linux in general (and I believe most or all of what I have to say is also true in general for any flavor *nix, but don't take my word for that). I also won't say much about "how to read logs" beyond answering this question: Is the assumption even correct ...


9

The obvious thing to do would be to go to the logrotate home page and look around for some version history. There you can find the original 0.1 release in version control, and the manual page for that release gives the author as "Erik Troan <ewt@redhat.com>" and the date as "Mon Nov 18 1996". This took about a minute.


8

It should be automatic via cron. You can force it to test your changes. For global logrotate: sudo logrotate -v -f /etc/logrotate.conf For a single conf file: sudo logrotate -v -f /etc/logrotate.d/someapp.conf


8

Yes. You're looking for tail -F instead of tail -f (that is, a capital F instead of lowercase). Check the tail(1) manpage. Alternatively, you could use --follow=name --retry, which the man page documents as the same thing. (These are from GNU coreutils tail. Other tails may not have this; POSIX does not specify -F, --follow, or --retry. If you have to work ...


8

The post rotate action appears to be incorrect Try invoke-rc.d nginx reload >/dev/null 2>&1 If you look at the nginx command you will see the actions it will accept. Also the message you got says check initctl --help xtian@fujiu1404:~/tmp$ initctl help Job commands: start Start job. stop Stop ...


7

logrotate is used by the system to rotate logs so you have 2 choices. You can either incorporate the rotation of these app logs into the systems rotations or setup your own and either run them manually or from the root user's crontab (Assuming the Rails app is run as root given it's directory is /root/...). System rotation To setup a logrotation within the ...


6

The logrotate option that does what you describe is copytruncate. Simply add this option to your existing logrotate config. Here is the excerpt from the logrotate.conf manual: copytruncate Truncate the original log file in place after creating a copy, instead of moving the old log file and optionally creating a new one, ...


5

Unix signal delivery is asynchronous. When the kill system call returns, the signal has been delivered to the process, but the process may not have reacted to it yet. You were lucky with the scheduler under 11.04. If the killed process has a handler for the signal, it can spend an arbitrarily long time before dying, or choose not to die as a result of the ...


5

The usual solution for this problem is to use rotate the logfiles so that the current logfile only contains current entries, rather than removing outdated entries from the file. This is all handled by the logrotate program. The following configuration should do approximately what you want. It will keep the last 6 months of log entries from /var/squid/logs/...


5

It's called logrotate because typically it is used to "rotate" logs to new files periodically -- that is, it doesn't delete or refresh them (at least from my interpretation of those words). One definition of "rotate" provided by the Random House Dictionary is: to cause to go through a cycle of changes or follow in a fixed routine of succession: to ...


5

The problem is that you're using the same logfile name in each of the entries. A weekly rotation happens once it's gone more than a week since the last time that log file was rotated. Since the file gets rotated each day, you'll never get to the weekly run. (You'll also never get to the montly run, for the same reason.) So, in order to keep the weekly and ...


4

logrotate can do it with olddir if your log file name is the same every time it runs and you can add dates. If your log file name changes i.e. YYYYMMDD then logrotate won't do it for you. # sample logrotate conf file copytruncate compress dateformat %Y%m%d. dateext extension log olddir ./logarchive /logs/sys.log { rotate 7 daily } Copies and ...


4

I recommend you to use http://cronolog.org/ This is how I use it: CustomLog "|/usr/local/sbin/cronolog -S /var/log/httpd/t3.CCC.eu-access_log -P /var/log/httpd/t3.CCC.eu-access_log.prev /var/log/httpd/t3.CCC.eu-%Y.log" combined


4

To cut the logs Apache project has a useful command rotatelogs designed to rotate input recieved via an input pipe Read about rotatelogs Then there is also the cronolog better time handling. Cronolog website But if you are also rotating then it's worth considering logrotate, but logrotate will need a mechanism to trigger a new logfile, (send a signal, ...


4

Most modern Linux distros include a tool called logrotate which the OS then uses to maintain the /var/log directory. You can use it too. It is kicked off via cron, so if you want the logs rotated with a certain frequency then you need to setup a cronjob that runs atleast that frequently. Examples This will rotate the 2 files access.log & error.log, ...


4

On my CentOS 6.5 machine for setting up logrotatefor nginx I had to do this: logrotate /etc/logrotate.d/nginx And then I checked if logrotate taking care of my new nginx config like this: cat /var/lib/logrotate.status


4

Here's some sample log file output: Feb 26 23:04:55 pegasus internal-sftp[32524]: session opened for local user joeuser from [123.123.123.123] Feb 26 23:04:57 pegasus internal-sftp[32524]: opendir "/home/joeuser" Feb 26 23:04:58 pegasus internal-sftp[32524]: closedir "/home/joeuser" Feb 26 23:05:01 pegasus internal-sftp[32524]: opendir "/home/joeuser/" Feb ...


4

X's logging behavior is: If there is a /var/log/Xorg.DISPLAY.log, rename it to /var/log/Xorg.DISPLAY.log.old, overwriting any file that might be there. Open /var/log/Xorg.DISPLAY.log, and begin logging to it. Unfortunately, this isn't configurable, except in the sense all open-source software is: you could change the source code and recompile. It's in ...


3

For what it's worth, logrotate uses glob.h (see: man 3 glob), which is documented very well in man 7 glob. It is similar in many ways to bash globbing (without extended globbing), but it's not identical. In particular, that means it supports: ? match a single character * match any string, including the empty string [...] match any of the listed ...


3

It's executed three times, once for each matching file. There's a hint in the man page: sharedscripts Normally, prerotate and postrotate scripts are run for each log which is rotated and the absolute path to the log file is passed as first argument to the script. That means a single script may be run multi- ple times for log file ...


3

There is logrotate which cleans /var/log regularly by using cron jobs. It is normally installed automatically (at least in Debian and its derivatives like Ubuntu).


3

You can run multiple instances of logrotate. They need to work on different sets of files and use different state-files. You should use gzip (standard compression) instead of bzip. AFAIK you can pass some extra options to gzip - so you can tell it to use faster compression.



Only top voted, non community-wiki answers of a minimum length are eligible