1

Other than a couple of basic VHOST's, I have default apache and apache logging configuration. Whenever I try to view my apache log files (error.log, access.log) I see that these files keep getting reordered and reorganised regularly, unfortunately I don't understand what the reason or methodology of this is.

From what I have read this log file manipulation is performed by a utility called "logrotate".
with a description from the manpage

logrotate is designed to ease administration of systems that generate large numbers of log files. It allows automatic rotation, compression, removal, and mailing of log files. Each log file may be handled daily, weekly, monthly, or when it grows too large.

I have read the following resources:

The above resources give a good technical explanation of how you would configure logrotate, but I'm failing to get a common sense explanation of what the point of log rotate is, and therefore some insight into how it works. I can see that it performs compression on some files, the benefit of that is obvious.

I understand that logrotate is a generic utility that processes log files for many services - and therefore its function changes per each config - but, in the context of apache 2.4 on Ubuntu 14.04 what does "logrotate" do?

3

The idea is that you always have a relatively fresh main file (such as access_log or error_log) which contains the latest entries. As the log becomes either too old or too large, logrotate creates archived files so that no information is discarded (something like access_log-YYYYMMDD).

Therefore, older logs can still be accessed without the main log file growing out of control in regards to size. Smaller files with less information are easier to read and debug - especially on busy servers where those logs can grow to several GB.

On CentOS for example, the Apache logs are rotated every 7 days.

You can delete the archive files at your leisure, or let logrotate handle the deletion too.

Check out man logrotate for more details.

  • Thanks, this answer was helpful. Also between this ubuntu.com article and the examples given in logrotate man pages I was able to understand how it worked, thanks – Michael Coleman Mar 7 '15 at 20:31
  • Great to hear it, Michael! Glad I could help, – Jay Versluis Mar 8 '15 at 16:41
0

The point of logrotate is that if an application is allowed to write indefinitely to a log-file,

  • you'll run out of diskspace, and
  • the files will grow too large to view (some people use vi on 100MB logfiles...)

So what it does is

  • provide a configurable way to rename the currently active file to a saved copy,
  • notify the service which is writing to the log-file to tell it to start a new file, and
  • provide a configurable way to tell how much diskspace to allow for saved copies

Just renaming the logfile won't work, since many programs keep the file open. If it is renamed, the program continues writing—to the renamed file.

Programs which are designed for use in logging are usually designed to respond to a signal. If not, (logrotate is configurable), services can be restarted as log-files grow large.

Further reading:

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.