Tag Info

Hot answers tagged

56

Use the -F option instead: tail -F /var/log/kern.log The -F option tells tail to track changes to the file by filename, instead of using the inode number which changes during rotation. It will also keep trying to open the file if it's not present.


30

Most likely, the log file is less than a day old and/or has been rotated within the last day and logrotate remembers the history. If you add -f it'll force a rotation if you really want to (although not 100% sure how that interacts with -d). You can look at the history, location depends on your distribution, but might be /var/lib/logrotate/status. That ...


20

The reason that apache needs a reload is that once it's opened a file, it gets a filehandle to it, and it will keep writing to that filehandle. When you move the file, it doesn't see that, it just keeps writing to the same handle. When you do a reload, it'll open the file again and get a new handle. To avoid the reload, instead of moving the file, you can ...


18

The first time you run logrotate with a new log configuration it doesn't know when the last log rotation occurred. So it just writes a status line in logrotate.status to the effect that it was run today. When it subsequently runs the following day, it sees that the log is a day old and rotates it as expected. If you don't want to wait, edit ...


14

That is probably a mistake, it is found only in one example on that tutorial. All other examples have copytruncate without the create option. Also logrotate man page says that is will be actually ignored: copytruncate Truncate the original log file to zero size in place after creating a copy, instead of moving the old log file and optionally ...


14

logrotate uses crontab to work. It's scheduled work, not a daemon, so no need to reload its configuration. When the crontab executes logrotate, it will use your new config file automatically. If you need to test your config you can also execute logrotate on your own with the command: logrotate /you/config/file Or as mentioned in comments, identify the ...


13

Depending on your OS. Some (all?) Linux distributions have a directory /etc/cron.hourly where you can put cron jobs to be executed every hour. Others have a directory /etc/cron.d/. There you can put cron-jobs that are to be executed as any special user with the usual cron-settings of a crontab entry (and you have to specify the username). If you use either ...


9

The obvious thing to do would be to go to the logrotate home page and look around for some version history. There you can find the original 0.1 release in version control, and the manual page for that release gives the author as "Erik Troan <ewt@redhat.com>" and the date as "Mon Nov 18 1996". This took about a minute.


8

I won't discuss logging with regard to ubuntu specifically much, since the topic is standardized for linux in general (and I believe most or all of what I have to say is also true in general for any flavor *nix, but don't take my word for that). I also won't say much about "how to read logs" beyond answering this question: Is the assumption even correct ...


8

Yes. You're looking for tail -F instead of tail -f (that is, a capital F instead of lowercase). Check the tail(1) manpage. Alternatively, you could use --follow=name --retry, which the man page documents as the same thing. (These are from GNU coreutils tail. Other tails may not have this; POSIX does not specify -F, --follow, or --retry. If you have to work ...


6

Most of the logrotate setups I've seen on various distros runs out of the /etc/cron.daily. There's a shell script there aptly named logroate. Example $ ls -l /etc/cron.daily/logrotate -rwxr-xr-x 1 root root 180 May 18 2011 /etc/cron.daily/logrotate Manual run If you want to make it run manually simply run the script as root. $ sudo ...


5

Unix signal delivery is asynchronous. When the kill system call returns, the signal has been delivered to the process, but the process may not have reacted to it yet. You were lucky with the scheduler under 11.04. If the killed process has a handler for the signal, it can spend an arbitrarily long time before dying, or choose not to die as a result of the ...


5

The usual solution for this problem is to use rotate the logfiles so that the current logfile only contains current entries, rather than removing outdated entries from the file. This is all handled by the logrotate program. The following configuration should do approximately what you want. It will keep the last 6 months of log entries from ...


5

It's called logrotate because typically it is used to "rotate" logs to new files periodically -- that is, it doesn't delete or refresh them (at least from my interpretation of those words). One definition of "rotate" provided by the Random House Dictionary is: to cause to go through a cycle of changes or follow in a fixed routine of succession: to ...


5

It should be automatic via cron. You can force it to test your changes. For global logrotate: sudo logrotate -v -f /etc/logrotate.conf For a single conf file: sudo logrotate -v -f /etc/logrotate.d/someapp.conf


4

I recommend you to use http://cronolog.org/ This is how I use it: CustomLog "|/usr/local/sbin/cronolog -S /var/log/httpd/t3.CCC.eu-access_log -P /var/log/httpd/t3.CCC.eu-access_log.prev /var/log/httpd/t3.CCC.eu-%Y.log" combined


4

logrotate is used by the system to rotate logs so you have 2 choices. You can either incorporate the rotation of these app logs into the systems rotations or setup your own and either run them manually or from the root user's crontab (Assuming the Rails app is run as root given it's directory is /root/...). System rotation To setup a logrotation within the ...


4

The logrotate option that does what you describe is copytruncate. Simply add this option to your existing logrotate config. Here is the excerpt from the logrotate.conf manual: copytruncate Truncate the original log file in place after creating a copy, instead of moving the old log file and optionally creating a new one, ...


3

For what it's worth, logrotate uses glob.h (see: man 3 glob), which is documented very well in man 7 glob. It is similar in many ways to bash globbing (without extended globbing), but it's not identical. In particular, that means it supports: ? match a single character * match any string, including the empty string [...] match any of the listed ...


3

It's executed three times, once for each matching file. There's a hint in the man page: sharedscripts Normally, prerotate and postrotate scripts are run for each log which is rotated and the absolute path to the log file is passed as first argument to the script. That means a single script may be run multi- ple times for log file ...


3

There is logrotate which cleans /var/log regularly by using cron jobs. It is normally installed automatically (at least in Debian and its derivatives like Ubuntu).


3

You can run multiple instances of logrotate. They need to work on different sets of files and use different state-files. You should use gzip (standard compression) instead of bzip. AFAIK you can pass some extra options to gzip - so you can tell it to use faster compression.


3

Please tell us more about your requirements - it's hard to guess what limits your server: disk i/o? You might want to spread out those logfiles over disks/filesystems cpu - is it compressing those logs as they are rotated? You might want to use a filesystem with internal compression, and even hardware acceleration. directory cache? see the answer by Chris ...


3

Here's a quickie script which will do what you need: #!/bin/bash LOGDIR=/var/log/somedir OLDLOGS=/var/log/keep-old-logs-here PATH=/bin:$PATH TODAY=$(date +'%Y%m%d') [ -d $OLDLOGS ] || mkdir -p $OLDLOGS cd $LOGDIR for LOG in $(ls | egrep '^[[:digit:]]{8}$'); do [ $LOG -lt $TODAY ] && gzip $LOG && mv $LOG.gz done Make the script ...


3

logrotate can do it with olddir if your log file name is the same every time it runs and you can add dates. If your log file name changes i.e. YYYYMMDD then logrotate won't do it for you. # sample logrotate conf file copytruncate compress dateformat %Y%m%d. dateext extension log olddir ./logarchive /logs/sys.log { rotate 7 daily } Copies and ...


3

You could write a little bash script to do this. Just tail the file to a certain byte count using tail -c and overwrite the file. from man tail: -c, --bytes=N output the last N bytes; alternatively, use +N to output bytes starting with the Nth of each file If the first character of N (the number of bytes or lines) is a ...


3

Nginx responds to the USR1 signal by reopening its log files. The USR1 signal kills a program by default, but it's meant to be handled to do whatever the program finds useful. Each program defines what it does with USR1 and USR2; for Nginx, that's reopening the log files (for log rotation) and executing a new instance (for upgrades). By convention, most ...


3

Here's some sample log file output: Feb 26 23:04:55 pegasus internal-sftp[32524]: session opened for local user joeuser from [123.123.123.123] Feb 26 23:04:57 pegasus internal-sftp[32524]: opendir "/home/joeuser" Feb 26 23:04:58 pegasus internal-sftp[32524]: closedir "/home/joeuser" Feb 26 23:05:01 pegasus internal-sftp[32524]: opendir "/home/joeuser/" Feb ...


3

Rotating a log file is not sufficient, you have to tell the process that's writing to it to stop as well. You typically can do this by sending a signal to the process, such as a HUP. Example /var/log/snmpd.log { notifempty missingok postrotate /bin/kill -HUP `cat /var/run/snmpd.pid 2> /dev/null` 2> /dev/null || true endscript ...


3

X's logging behavior is: If there is a /var/log/Xorg.DISPLAY.log, rename it to /var/log/Xorg.DISPLAY.log.old, overwriting any file that might be there. Open /var/log/Xorg.DISPLAY.log, and begin logging to it. Unfortunately, this isn't configurable, except in the sense all open-source software is: you could change the source code and recompile. It's in ...



Only top voted, non community-wiki answers of a minimum length are eligible