View source for Linux System Log Rotation

<nowiki>/etc/logrotate.d</nowiki>
 <nowiki>--------------------------------------------------------------------------------</nowiki>
 <nowiki></nowiki>
 <nowiki>Setting up and verifying system logging: syslog and klog; /etc/syslog.conf;</nowiki>
 <nowiki>remote logging; monitoring logs using swatch; managing logs using log rotate. </nowiki>
 <nowiki></nowiki>
 <nowiki>It is possible to force log rotation to test new configuration.</nowiki>
 <nowiki></nowiki>
 <nowiki>{</nowiki>
 <nowiki>  dbw comment: invalid entries in logrotate.conf - such as logs for customer </nowiki>
 <nowiki>  web directories since deleted, can cause logrotate to fail completely!  You</nowiki>
 <nowiki>  _can_ force a log rotation checking your logrotate.conf file for validity.</nowiki>
 <nowiki>  syntax: logrotate -f /etc/logrotate.conf</nowiki>
 
 Test without actually rotating and show details: logrotate -vd /etc/logrotate.conf
 
 <nowiki>}</nowiki>
 <nowiki></nowiki>
 <nowiki>man logrotate</nowiki>
 <nowiki></nowiki>
 <nowiki>--------------------------------------------------------------------------------</nowiki>
 <nowiki>#note: endscript should appear only in the last entry if in logrotate.d</nowiki>
 <nowiki>#      and should not appear at all if in logrotate.conf</nowiki>
 <nowiki>--------------------------------------------------------------------------------</nowiki>
 <nowiki>How logrotate is invoked from cron. </nowiki>
 <nowiki>On one of my RedHat 5.2 systems, `crond' is started from the script </nowiki>
 <nowiki>/etc/rc.d/init.d/crond. The manual `man cron' says that cron </nowiki>
 <nowiki></nowiki>
 <nowiki>searches for /etc/crontab and the files in the /etc/cron.d/ directory.</nowiki>
 <nowiki></nowiki>
 <nowiki>My /etc/crontab file contains the following. </nowiki>
 <nowiki>SHELL=/bin/bash</nowiki>
 <nowiki>PATH=/sbin:/bin:/usr/sbin:/usr/bin</nowiki>
 <nowiki>MAILTO=root</nowiki>
 <nowiki></nowiki>
 <nowiki># run-parts</nowiki>
 <nowiki>01 * * * * root run-parts /etc/cron.hourly</nowiki>
 <nowiki>02 4 * * * root run-parts /etc/cron.daily</nowiki>
 <nowiki>22 4 * * 0 root run-parts /etc/cron.weekly</nowiki>
 <nowiki>0  0 1 * * root run-parts /etc/cron.monthly</nowiki>
 <nowiki></nowiki>
 <nowiki>And the /etc/cron.d directory contains nothing. </nowiki>
 <nowiki>So clearly, any logrotate commands are being run out of one or more of the </nowiki>
 <nowiki>/etc/cron.* files. The manual `man 5 crontab' indicates that the above </nowiki>
 <nowiki>commands mean that the program `run-parts' will be run as user `root' for </nowiki>
 <nowiki>each of the scripts. </nowiki>
 <nowiki></nowiki>
 <nowiki>The command `run-parts' turns out to be the script /usr/bin/run-parts, which </nowiki>
 <nowiki>is very short, as follows. </nowiki>
 <nowiki></nowiki>
 <nowiki>#!/bin/bash</nowiki>
 <nowiki></nowiki>
 <nowiki># run-parts - concept taken from Debian</nowiki>
 <nowiki></nowiki>
 <nowiki># keep going when something fails</nowiki>
 <nowiki>set +e</nowiki>
 <nowiki></nowiki>
 <nowiki>if [ $# -lt 1 ]; then</nowiki>
 <nowiki>        echo "Usage: run-parts <dir>"</nowiki>
 <nowiki>        exit 1</nowiki>
 <nowiki>fi</nowiki>
 <nowiki></nowiki>
 <nowiki>if [ ! -d $1 ]; then</nowiki>
 <nowiki>        echo "Not a directory: $1"</nowiki>
 <nowiki>        exit 1</nowiki>
 <nowiki>fi</nowiki>
 <nowiki></nowiki>
 <nowiki>for i in $1/* ; do</nowiki>
 <nowiki>        [ -d $i ] && continue</nowiki>
 <nowiki>        if [ -x $i ]; then</nowiki>
 <nowiki>                $i</nowiki>
 <nowiki>        fi</nowiki>
 <nowiki>done</nowiki>
 <nowiki></nowiki>
 <nowiki>exit 0</nowiki>
 <nowiki></nowiki>
 <nowiki>In essence, this just runs all of the scripts in the specified directory. </nowiki>
 <nowiki>E.g. each hour, the executable plain files in /etc/cron.hourly are run. </nowiki>
 <nowiki>It turns out that the `logrotate' program is invoked from /etc/cron.daily. </nowiki>
 <nowiki>This is the contents of the file /etc/cron.daily/logrotate. </nowiki>
 <nowiki></nowiki>
 <nowiki>#!/bin/sh</nowiki>
 <nowiki></nowiki>
 <nowiki>/usr/sbin/logrotate /etc/logrotate.conf</nowiki>
 <nowiki></nowiki>
 <nowiki>This means that the only file that `logrotate' gets its instructions from </nowiki>
 <nowiki>directly is /etc/logrotate.conf, which contains the following lines. </nowiki>
 <nowiki># see "man logrotate" for details</nowiki>
 <nowiki># rotate log files weekly</nowiki>
 <nowiki>weekly</nowiki>
 <nowiki></nowiki>
 <nowiki># keep 8 weeks worth of backlogs</nowiki>
 <nowiki>rotate 8</nowiki>
 <nowiki></nowiki>
 <nowiki># send errors to root</nowiki>
 <nowiki>errors root</nowiki>
 <nowiki></nowiki>
 <nowiki># create new (empty) log files after rotating old ones</nowiki>
 <nowiki>create</nowiki>
 <nowiki></nowiki>
 <nowiki># uncomment this if you want your log files compressed</nowiki>
 <nowiki>#compress</nowiki>
 <nowiki></nowiki>
 <nowiki># RPM packages drop log rotation information into this directory</nowiki>
 <nowiki>include /etc/logrotate.d</nowiki>
 <nowiki></nowiki>
 <nowiki># no packages own lastlog or wtmp -- we'll rotate them here</nowiki>
 <nowiki>/var/log/wtmp {</nowiki>
 <nowiki>    monthly</nowiki>
 <nowiki>    rotate 1</nowiki>
 <nowiki>}</nowiki>
 <nowiki></nowiki>
 <nowiki># system-specific logs may be configured here</nowiki>
 <nowiki></nowiki>
 <nowiki>This is all explained in the manual `man logrotate'.  </nowiki>
 <nowiki></nowiki>
 <nowiki></nowiki>
 <nowiki>Operation of logrotate. </nowiki>
 <nowiki>The directory /etc/logrotate.d contains the following files. </nowiki>
 <nowiki></nowiki>
 <nowiki>-rw-r--r--   1 root     root          354 Oct 13  1998 apache</nowiki>
 <nowiki>-rw-r--r--   1 root     root          108 Aug 28  1999 cron</nowiki>
 <nowiki>-rw-r--r--   1 root     root          188 Oct 14  1998 linuxconf</nowiki>
 <nowiki>-rw-r--r--   1 root     root          156 Oct 13  1998 mgetty</nowiki>
 <nowiki>-rw-r--r--   1 root     root          327 Aug 12  1998 syslog</nowiki>
 <nowiki>-rw-r--r--   1 root     root          457 Sep 10  1998 uucp</nowiki>
 <nowiki></nowiki>
 <nowiki>The file /etc/logrotate.d/apache is the one I'm interested in for this </nowiki>
 <nowiki>exercise. This file contains the following. </nowiki>
 <nowiki></nowiki>
 <nowiki>/var/log/httpd/access_log {</nowiki>
 <nowiki>    postrotate</nowiki>
 <nowiki>        /usr/bin/killall -HUP httpd</nowiki>
 <nowiki>    endscript</nowiki>
 <nowiki>}</nowiki>
 <nowiki></nowiki>
 <nowiki>/var/log/httpd/agent_log {</nowiki>
 <nowiki>    postrotate</nowiki>
 <nowiki>        /usr/bin/killall -HUP httpd</nowiki>
 <nowiki>    endscript</nowiki>
 <nowiki>}</nowiki>
 <nowiki></nowiki>
 <nowiki>/var/log/httpd/error_log {</nowiki>
 <nowiki>    postrotate</nowiki>
 <nowiki>        /usr/bin/killall -HUP httpd</nowiki>
 <nowiki>    endscript</nowiki>
 <nowiki>}</nowiki>
 <nowiki></nowiki>
 <nowiki>/var/log/httpd/referer_log {</nowiki>
 <nowiki>    postrotate</nowiki>
 <nowiki>        /usr/bin/killall -HUP httpd</nowiki>
 <nowiki>    endscript</nowiki>
 <nowiki>}</nowiki>
 <nowiki></nowiki>
 <nowiki>When I installed the latest version of Apache to get the PHP3 and </nowiki>
 <nowiki>PostgreSQL to work (around 20 March 2000) on my web server machine, </nowiki>
 <nowiki>I installed Apache so that the log files were in /home2/apache/logs </nowiki>
 <nowiki>instead of /var/log/httpd. </nowiki>
 <nowiki></nowiki>
 <nowiki>Therefore what I need to do now is to modify the </nowiki>
 <nowiki>/etc/logrotate.d/apache file so that the files referred to are all </nowiki>
 <nowiki>in the directory /home2/apache/logs instead. My new </nowiki>
 <nowiki>/etc/logrotate.d/apache script is as follows, and I saved the old </nowiki>
 <nowiki>one in directory /etc/logrotate.d/old1. </nowiki>
 <nowiki></nowiki>
 <nowiki># The new improved logrotate script for apache on fox.</nowiki>
 <nowiki></nowiki>
 <nowiki>/home2/apache/logs/*-access_log {</nowiki>
 <nowiki>    rotate 9</nowiki>
 <nowiki>    monthly</nowiki>
 <nowiki>    errors akenning@fox.topology.org</nowiki>
 <nowiki>    create</nowiki>
 <nowiki>    ifempty</nowiki>
 <nowiki>    olddir /home2/apache/logs/oldlogs</nowiki>
 <nowiki>    postrotate</nowiki>
 <nowiki>        /usr/bin/killall -HUP httpd</nowiki>
 <nowiki>    endscript</nowiki>
 <nowiki>    }</nowiki>
 <nowiki></nowiki>
 <nowiki>/home2/apache/logs/*-combref_log {</nowiki>
 <nowiki>    rotate 9</nowiki>
 <nowiki>    monthly</nowiki>
 <nowiki>    errors akenning@fox.topology.org</nowiki>
 <nowiki>    create</nowiki>
 <nowiki>    ifempty</nowiki>
 <nowiki>    olddir /home2/apache/logs/oldlogs</nowiki>
 <nowiki>    postrotate</nowiki>
 <nowiki>        /usr/bin/killall -HUP httpd</nowiki>
 <nowiki>    endscript</nowiki>
 <nowiki>    }</nowiki>
 <nowiki></nowiki>
 <nowiki>/home2/apache/logs/*-error_log {</nowiki>
 <nowiki>    rotate 9</nowiki>
 <nowiki>    monthly</nowiki>
 <nowiki>    errors akenning@fox.topology.org</nowiki>
 <nowiki>    create</nowiki>
 <nowiki>    ifempty</nowiki>
 <nowiki>    olddir /home2/apache/logs/oldlogs</nowiki>
 <nowiki>    postrotate</nowiki>
 <nowiki>        /usr/bin/killall -HUP httpd</nowiki>
 <nowiki>    endscript</nowiki>
 <nowiki>    }</nowiki>
 <nowiki></nowiki>
 <nowiki>--------------------------------------------------------------------------------</nowiki>
 <nowiki></nowiki>
 <nowiki>Now on Sunday 30 September 2001, it's time to get `logrotate' going on my new </nowiki>
 <nowiki>SuSE 7.1 web server `dog'. The problem is that SuSE 7.1 does not come with </nowiki>
 <nowiki>logrotate software on it. So I had to go and look for it. The link at redhat</nowiki>
 <nowiki>was </nowiki>
 <nowiki>wrong, but by looking around a bit, I finally found it at </nowiki>
 <nowiki>ftp://ftp.redhat.com/pub/redhat/linux/code/logrotate/ </nowiki>
 <nowiki>I downloaded this file: logrotate-3.3.tar.gz. This can be compiled very simply </nowiki>
 <nowiki>with `make' and `make install'. There's a manual logrotate.8 with it too. The </nowiki>
 <nowiki>binary is installed as /usr/sbin/logrotate. So now all I have to do is write a </nowiki>
 <nowiki>configuration file for the logrotate program and then write a cron script for</nowiki>
 <nowiki>it. </nowiki>
 <nowiki>(Note that since my main initial consideration is to rotate the httpd logs for </nowiki>
 <nowiki>the beginning of October 2001, I could just use the Apache tool for this</nowiki>
 <nowiki>purpose, </nowiki>
 <nowiki>which is /usr/local/apache/bin/rotatelogs on my system. However, I can't </nowiki>
 <nowiki>understand the documentation for this. So I'm playing safe and using the more </nowiki>
 <nowiki>flexible redhat `logrotate' tool instead.) </nowiki>
 <nowiki></nowiki>
 <nowiki>On my SuSE 7.1 machine `dog', the manual says that after reading the per-user </nowiki>
 <nowiki>crontab files in /var/spool/cron/tabs on start-up, the cron process reads the </nowiki>
 <nowiki>file /etc/crontab. On my machine as configured, I find the following. </nowiki>
 <nowiki></nowiki>
 <nowiki>root@dog# more /etc/crontab</nowiki>
 <nowiki>SHELL=/bin/sh</nowiki>
 <nowiki>PATH=/usr/bin:/usr/sbin:/sbin:/bin:/usr/lib/news/bin</nowiki>
 <nowiki>MAILTO=root</nowiki>
 <nowiki></nowiki>
 <nowiki>#-* * * * *    root  test -x /usr/sbin/atrun && /usr/sbin/atrun</nowiki>
 <nowiki>0 21 * * *     root  test -x /usr/sbin/faxqclean && /usr/sbin/faxqclean</nowiki>
 <nowiki>5 22 * * *     root  test -x /usr/sbin/texpire && /usr/sbin/texpire</nowiki>
 <nowiki>25 23 * * *    root  test -e /usr/sbin/faxcron && sh /usr/sbin/faxcron | mail</nowiki>
 <nowiki>FaxMaster</nowiki>
 <nowiki></nowiki>
 <nowiki>#</nowiki>
 <nowiki># check scripts in cron.hourly, cron.daily, cron.weekly, and cron.monthly</nowiki>
 <nowiki>#</nowiki>
 <nowiki>-*/15 * * * *   root  test -x /usr/lib/cron/run-crons &&</nowiki>
 <nowiki>/usr/lib/cron/run-crons</nowiki>
 <nowiki>59 *  * * *     root  rm -f /var/spool/cron/lastrun/cron.hourly</nowiki>
 <nowiki>14 0  * * *     root  rm -f /var/spool/cron/lastrun/cron.daily</nowiki>
 <nowiki>29 0  * * 6     root  rm -f /var/spool/cron/lastrun/cron.weekly</nowiki>
 <nowiki>44 0  1 * *     root  rm -f /var/spool/cron/lastrun/cron.monthly</nowiki>
 <nowiki></nowiki>
 <nowiki>There's nothing here to help me with initiating my daily script. (By the way, </nowiki>
 <nowiki>the fax commands are a bit worrying. I'll get rid of those when I understand </nowiki>
 <nowiki>exactly what they do. They obviously produce many meaningless message which </nowiki>
 <nowiki>root receives every day!) </nowiki>
 <nowiki></nowiki>
 <nowiki>So my next step is to look at the files in /etc/cron.d, because the cron</nowiki>
 <nowiki>manual </nowiki>
 <nowiki>says that all scripts in this directory are read next. On my machine the only </nowiki>
 <nowiki>file in /etc/cron.d is a script `seccheck', which produces copious useless </nowiki>
 <nowiki>messages to root every day and week. (I'll see if I can get rid of that some </nowiki>
 <nowiki>day too!) </nowiki>
 <nowiki></nowiki>
 <nowiki>The directory /etc/cron.daily contains a script `aaa_base_rotate_logs' which </nowiki>
 <nowiki>contains a complex set of rotation rules, but how are the scripts in this </nowiki>
 <nowiki>directory invoked? Hmmm... Maybe they're invoked from that </nowiki>
 <nowiki>`/usr/lib/cron/run-crons' script. Yes!! That's where it's invoked from. Yet </nowiki>
 <nowiki>another big, incomprehensible script. The core of that script is the following </nowiki>
 <nowiki>Bourne-shell loop. </nowiki>
 <nowiki></nowiki>
 <nowiki>SPOOL=/var/spool/cron/lastrun</nowiki>
 <nowiki>for CRONDIR in /etc/cron.{hourly,daily,weekly,monthly} ; do</nowiki>
 <nowiki>    test -d $CRONDIR || continue</nowiki>
 <nowiki>    BASE=${CRONDIR##*/}</nowiki>
 <nowiki>    test -e $SPOOL/$BASE && {</nowiki>
 <nowiki>        case $BASE in</nowiki>
 <nowiki>          cron.hourly)  TIME="-cmin  +60 -or -cmin  60" ;;</nowiki>
 <nowiki>          cron.daily)   TIME="-ctime +1  -or -ctime 1"  ;;</nowiki>
 <nowiki>          cron.weekly)  TIME="-ctime +7  -or -ctime 7"  ;;</nowiki>
 <nowiki>          cron.monthly) TIME="-ctime +`date -u +%d`"    ;;</nowiki>
 <nowiki>        esac</nowiki>
 <nowiki>        eval find $SPOOL/$BASE $TIME | xargs -r rm -f</nowiki>
 <nowiki>    }</nowiki>
 <nowiki>    if test ! -e $SPOOL/$BASE ; then</nowiki>
 <nowiki>        touch $SPOOL/$BASE</nowiki>
 <nowiki></nowiki>
 <nowiki>        # keep going when something fails</nowiki>
 <nowiki>        set +e</nowiki>
 <nowiki>        for SCRIPT in $CRONDIR/*[^~,] ; do</nowiki>
 <nowiki>            test -d $SCRIPT && continue</nowiki>
 <nowiki>            test -x $SCRIPT || continue</nowiki>
 <nowiki>           case "$SCRIPT" in</nowiki>
 <nowiki>               *.rpm*)         continue ;;</nowiki>
 <nowiki>               *.swap)         continue ;;</nowiki>
 <nowiki>               *.bak)          continue ;;</nowiki>
 <nowiki>               *.orig)         continue ;;</nowiki>
 <nowiki>               \#*)            continue ;;</nowiki>
 <nowiki>           esac</nowiki>
 <nowiki>           /sbin/checkproc $SCRIPT && continue</nowiki>
 <nowiki>           nice -15 $SCRIPT</nowiki>
 <nowiki>        done</nowiki>
 <nowiki>    fi</nowiki>
 <nowiki>done</nowiki>
 <nowiki></nowiki>
 <nowiki>Now what does this mean? </nowiki>
 <nowiki>The command `BASE=${CRONDIR##*/}' means that BASE is set to the `longest </nowiki>
 <nowiki>substring of $CRONDIR which matches pattern "*/"', according to my Bash </nowiki>
 <nowiki>reference card. This just means that the leading path components are removed. </nowiki>
 <nowiki>(This is done more simply in C-shell!) In the case of the daily cron job, if </nowiki>
 <nowiki>there is a file /var/spool/cron/lastrun/cron.daily (which is true), then the </nowiki>
 <nowiki>following command is run. </nowiki>
 <nowiki>eval find /var/spool/cron/lastrun/cron.daily -ctime +1 -or -ctime 1 | xargs -r</nowiki>
 <nowiki>rm -f</nowiki>
 <nowiki></nowiki>
 <nowiki>The `xargs' command (which I have never seen before) builds and executes a </nowiki>
 <nowiki>command line from standard input. Wierd! The `xargs' manual says this. </nowiki>
 <nowiki></nowiki>
 <nowiki>If  the  standard  input  does not contain any non-blanks,</nowiki>
 <nowiki>do not run the command.  Normally, the command is run once</nowiki>
 <nowiki>even if there is no input.</nowiki>
 <nowiki></nowiki>
 <nowiki>So in this case, the command `rm -f' is executed for each of the files with </nowiki>
 <nowiki>modification times within 24 hours of the current time. I don't really </nowiki>
 <nowiki>understand this. </nowiki>
 <nowiki></nowiki>
 <nowiki>It looks like the file removal commands in the file /etc/crontab are designed </nowiki>
 <nowiki>to synchronise the operation of the quarter-hour operations. The commands are </nowiki>
 <nowiki>only executed if the files in /var/spool/cron/lastrun have been removed. What </nowiki>
 <nowiki>a convoluted way of achieving a simple objective!! </nowiki>
 <nowiki></nowiki>
 <nowiki>Next any file in the directory /etc/cron.daily which do not end in the </nowiki>
 <nowiki>characters `~' or `,' (presumed to be edited files) are executed if they are </nowiki>
 <nowiki>executable and do not have the endings .rpm, .swap, .bak or .orig as follows. </nowiki>
 <nowiki></nowiki>
 <nowiki>           /sbin/checkproc $SCRIPT && continue</nowiki>
 <nowiki>           nice -15 $SCRIPT</nowiki>
 <nowiki></nowiki>
 <nowiki>The loop continues is the process is already running. Otherwise it is run with </nowiki>
 <nowiki>nice level 15. </nowiki>
 <nowiki></nowiki>
 <nowiki>What this all means finally is that any script in the directory</nowiki>
 <nowiki>/etc/cron.daily </nowiki>
 <nowiki>will be run at 00:00 on each day. More to the point, the /etc/cron.monthly </nowiki>
 <nowiki>scripts are run at 00:00 at the beginning of each month. It all looks a bit </nowiki>
 <nowiki>dodgy because the `date' test is `date -u', which gives the current UTC day. </nowiki>
 <nowiki>But this should work, although the motivation for the `-u' is not quite clear. </nowiki>
 <nowiki></nowiki>
 <nowiki>All I have to do now is write a script and put it in /etc/cron.monthly. No</nowiki>
 <nowiki>problem! </nowiki>
 <nowiki></nowiki>
 <nowiki>--------------------------------------------------------------------------------</nowiki>
 <nowiki>sample methods:</nowiki>
 <nowiki></nowiki>
 <nowiki># system-specific logs may be configured here </nowiki>
 <nowiki> ## rotate apache logs weekly, keeping 8 rotations</nowiki>
 <nowiki> /www/apache/var/logs/*log {</nowiki>
 <nowiki>     rotate 8</nowiki>
 <nowiki>     postrotate</nowiki>
 <nowiki>       kill -HUP `cat /www/apache/var/logs/httpd.pid`</nowiki>
 <nowiki>     endscript</nowiki>
 <nowiki> }</nowiki>
 <nowiki> ## rotate rembo logs weekly, keeping 4 rotations</nowiki>
 <nowiki> /opt/rembo/logs/*.log {</nowiki>
 <nowiki>     rotate 4</nowiki>
 <nowiki>     postrotate</nowiki>
 <nowiki>       /etc/rc.d/init.d/rembo stop</nowiki>
 <nowiki>       /etc/rc.d/init.d/rembo start</nowiki>
 <nowiki>     endscript</nowiki>
 <nowiki> }</nowiki>
 <nowiki></nowiki>
 <nowiki>--------------------------------------------------------------------------------</nowiki>
 <nowiki>the roach method (for virtual hosting):</nowiki>
 <nowiki></nowiki>
 <nowiki>I have many virtual hosts.  I feared that apache would be start/stop</nowiki>
 <nowiki>frequently,</nowiki>
 <nowiki>once per virtual host, during the rotation process.  Therefore, I decided to</nowiki>
 <nowiki>use</nowiki>
 <nowiki>the 'copytruncate' option.  With this option the apache web server does not </nowiki>
 <nowiki>require a restart. -roach</nowiki>
 <nowiki></nowiki>
 <nowiki>/usr/apache/log/*log {</nowiki>
 <nowiki>    weekly</nowiki>
 <nowiki>    rotate 52</nowiki>
 <nowiki>    notifempty</nowiki>
 <nowiki>    missingok</nowiki>
 <nowiki>    copytruncate</nowiki>
 <nowiki>}</nowiki>
 <nowiki></nowiki>
 <nowiki>/usr/apache/log/dynahost.dbw.org/*log {</nowiki>
 <nowiki>    weekly</nowiki>
 <nowiki>    rotate 52</nowiki>
 <nowiki>    notifempty</nowiki>
 <nowiki>    missingok</nowiki>
 <nowiki>    copytruncate</nowiki>
 <nowiki>}</nowiki>
 <nowiki></nowiki>
 <nowiki>--------------------------------------------------------------------------------</nowiki>
 <nowiki>Configure the new /etc/logrotate.d/apache file</nowiki>
 <nowiki>Now Apache logs files residing in the /chroot/var/log/httpd directory instead</nowiki>
 <nowiki>of </nowiki>
 <nowiki>/var/log/httpd and for this reason we need to modify the</nowiki>
 <nowiki>/etc/logrotate.d/httpd </nowiki>
 <nowiki>file to point to the new chrooted directory. Also, we've compiled Apache with </nowiki>
 <nowiki>mod_ssl, so we'll add one more line to permit the logrotate program to rotate </nowiki>
 <nowiki>the ssl_request_log and ssl_engine_log files. Configure your </nowiki>
 <nowiki>/etc/logrotate.d/apache file to rotate your log files each week automatically. </nowiki>
 <nowiki></nowiki>
 <nowiki>Create the apache file, touch /etc/logrotate.d/apache and add:         </nowiki>
 <nowiki>/chroot/httpd/var/log/httpd/access_log {</nowiki>
 <nowiki>        missingok</nowiki>
 <nowiki>        postrotate</nowiki>
 <nowiki>        /usr/bin/killall -HUP /chroot/httpd/usr/sbin/httpd</nowiki>
 <nowiki>        endscript</nowiki>
 <nowiki>        }</nowiki>
 <nowiki></nowiki>
 <nowiki>        /chroot/httpd/var/log/httpd/error_log {</nowiki>
 <nowiki>        missingok</nowiki>
 <nowiki>        postrotate</nowiki>
 <nowiki>        /usr/bin/killall -HUP /chroot/httpd/usr/sbin/httpd</nowiki>
 <nowiki>        endscript</nowiki>
 <nowiki>        }</nowiki>
 <nowiki></nowiki>
 <nowiki>        /chroot/httpd/var/log/httpd/ssl_request_log {</nowiki>
 <nowiki>        missingok</nowiki>
 <nowiki>        postrotate</nowiki>
 <nowiki>        /usr/bin/killall -HUP /chroot/httpd/usr/sbin/httpd</nowiki>
 <nowiki>        endscript</nowiki>
 <nowiki>        }</nowiki>
 <nowiki></nowiki>
 <nowiki>        /chroot/httpd/var/log/httpd/ssl_engine_log {</nowiki>
 <nowiki>        missingok</nowiki>
 <nowiki>        postrotate</nowiki>
 <nowiki>        /usr/bin/killall -HUP /chroot/httpd/usr/sbin/httpd</nowiki>
 <nowiki>        endscript</nowiki>
 <nowiki>        }</nowiki>
 <nowiki></nowiki>
 <nowiki>--------------------------------------------------------------------------------</nowiki>
 <nowiki>Credits and Quasi-bibliography:</nowiki>
 <nowiki></nowiki>
 <nowiki>The majority of this text is from:</nowiki>
 <nowiki>http://www.topology.org/linux/logrotate.html</nowiki>
 <nowiki>Reference: Alan Kennington's </nowiki>
 <nowiki></nowiki>
 <nowiki>Some information was gathered from:</nowiki>
 <nowiki>http://misc.epfl.ch/rembo/logrotate_conf.html</nowiki>
 <nowiki>Reference: Unknown</nowiki>
 <nowiki></nowiki>
 <nowiki>Securing and Optimizing Linux: RedHat Edition -A Hands on Guide </nowiki>
 <nowiki>http://www.tldp.org/LDP/solrhe/Securing-Optimizing-Linux-RH-Edition-v1.3/chap29sec258.html</nowiki>
 <nowiki></nowiki>
 <nowiki>Anything else was created by:</nowiki>
 <nowiki>roach</nowiki>
 <nowiki></nowiki>
 <nowiki>date: Sun May 12 18:03:33 CDT 2002</nowiki>
 <nowiki>--------------------------------------------------------------------------------</nowiki>
 <nowiki></nowiki>
 <nowiki>Logrotate: error reading top line of /var/lib/logrotate.status</nowiki>
 <nowiki></nowiki>
 <nowiki>If you get an error saying</nowiki>
 <nowiki></nowiki>
 <nowiki>/etc/cron.daily/logrotate:</nowiki>
 <nowiki></nowiki>
 <nowiki>error: error reading top line of /var/lib/logrotate.status</nowiki>
 <nowiki></nowiki>
 <nowiki>delete /var/lib/logrotate.status, and then run logrotate once with -f flag,</nowiki>
 <nowiki>like</nowiki>
 <nowiki></nowiki>
 <nowiki> #> logrotate -f /etc/logrorate.d/syslog</nowiki>
 <nowiki></nowiki>
 <nowiki>This should initialize the status file and the error should not be repeating.</nowiki>
 <nowiki></nowiki>
 <nowiki></nowiki>
 <nowiki></nowiki>

== Virtual Host Log Rotation for Apache ==

Many linux distributions include a utility called logrotate.d which is installed and configured by default.  It is configured to rotate the main Apache log file typically weekly or monthly.  Yet, Apache configuration for virtual hosts (virtual_host) suggests creating separate logs for each virtual host, and in a directory named for the site.  This is typically under the primary Apache log directory.  Consider a server where /var/log/apache2/access.log is the primary apache log, but there is a virtual host which a log under /var/log/apache2/www.smokinghotbabes.com/access.log. Now looking in /etc/logrotate.d/httpd the default config is:

 /var/log/apache2/*.log {
     missingok
     notifempty
     postrotate 
 	/usr/bin/killall -HUP httpd
     endscript
 }

This default installed configuration for logrotate.d/httpd will only rotate the primary web site.  It will not rotate virtual host sites.  This can be amended by adding another part to the log rotation configuration script:

 /var/log/apache2/*.log {
     missingok
     notifempty
     postrotate 
 	/usr/bin/killall -HUP httpd
     endscript
 }

 /var/log/apache2/*/*.log {
     missingok
     notifempty
     postrotate 
 	/usr/bin/killall -HUP httpd
     endscript
 }

== configuration testing and some important flags ==

=== Verbose ===
-v  tells logrotate to say what it’s doing while it’s doing it. It’s very useful when trying to find out why logrotate doesn’t rotate a log when you want it to.

=== Debug ===
-d  tells logrotate to go through the motions of rotating logs but not actually rotate them.  Good for checking that the config file is formatted properly and that logrotate can find the log files it would rotate. It doesn’t actually run the rotations and it doesn’t test some parts of the process like the postrotate scripts.

=== Force ===

-f  forces logrotate to rotate all logs, whether or not they would normally need to be rotated at that time. 

== External Resources ==

* [http://www.thegeekstuff.com/2010/07/logrotate-examples/ HowTo: The Ultimate Logrotate Command Tutorial with 10 Examples]
* [http://aaron.kavlie.net/2010/05/server-admin/apache-logs-and-logrotate-d/ Apache logs and logrotate.d]
* [http://www.rackspace.com/knowledge_center/article/understanding-logrotate-part-2 Understanding logrotate - part 2]

&nbsp;

[[Category:Computer_Technology]]
[[Category:Linux]]