I have been running SuSE 9.0 for about 6 months and while the system has never slowed down, I am beginning to think that with all the logging linux does, that the log files are getting a little large. Am I right in saying that logrotate is already doing this or does it need to be set up/edited? If I browse /, I see there is a /etc/logrotated directory with various files in it, are these the only logs that are logrotated and can other files be placed in the directory by me, in the right format, and also get logrotated? Is there a SuSE HOWTO on setting up logrotate files or is it done by the system from time to time. What do all the entries in each section mean ie if i wanted to change how often it does it, is there a number I can change? -- ======================================================================== Hylton Conacher - Registered Linux user # 229959 at http://counter.li.org Currently using SuSE 9.0 Professional with KDE 3.1 Licenced Windows user ========================================================================
* Hylton Conacher (ZR1HPC)
Am I right in saying that logrotate is already doing this or does it need to be set up/edited?
for the *default* files which you can see listed in the /etc/logrotate.d/ directory.
If I browse /, I see there is a /etc/logrotated directory with various files in it, are these the only logs that are logrotated and can other files be placed in the directory by me, in the right format, and also get logrotated?
yes, yes, yes
Is there a SuSE HOWTO on setting up logrotate files or is it done by the system from time to time.
man logrotate
What do all the entries in each section mean ie if i wanted to change how often it does it, is there a number I can change?
man logrotate This script has one of the better man files. It is specific and very descriptive and offers examples. Look thru the entries in the /etc/logrotate.d/ directory and read the man file. You will quickly find what you need to extend this service. -- Patrick Shanahan Registered Linux User #207535 http://wahoo.no-ip.org @ http://counter.li.org HOG # US1244711
Patrick Shanahan wrote:
* Hylton Conacher (ZR1HPC)
[06-02-04 12:39]: Am I right in saying that logrotate is already doing this or does it need to be set up/edited?
for the *default* files which you can see listed in the /etc/logrotate.d/ directory.
If I browse /, I see there is a /etc/logrotated directory with various files in it, are these the only logs that are logrotated and can other files be placed in the directory by me, in the right format, and also get logrotated?
yes, yes, yes
Is there a SuSE HOWTO on setting up logrotate files or is it done by the system from time to time.
man logrotate
What do all the entries in each section mean ie if i wanted to change how often it does it, is there a number I can change?
man logrotate
This script has one of the better man files. It is specific and very descriptive and offers examples. Look thru the entries in the /etc/logrotate.d/ directory and read the man file. You will quickly find what you need to extend this service. I had a feeling you were going to say RTFM Patrick. Tnx I have already and will slowly work thru it. I just wondered if there was perhaps an easier way, perhaps using X, to do this on a SuSE 9.0 system.
One question already whilst reading the man pages, does logrotate have to be manually run or does it do its own thing with no setup from the user? I tried: linux:~ # logrotate -usage logrotate: bad argument -usage: unknown error How can I found out it has run recently without specifying a particular file because there is very little chance of me browsing /var/log/messages and looking for logrotate? -- ======================================================================== Hylton Conacher - Linux user # 229959 at http://counter.li.org Currently using SuSE 9.0 Professional with KDE 3.1 Licenced Windows user ========================================================================
* Hylton Conacher (ZR1HPC)
Patrick Shanahan wrote:
man logrotate
This script has one of the better man files. It is specific and very descriptive and offers examples. Look thru the entries in the /etc/logrotate.d/ directory and read the man file. You will quickly find what you need to extend this service. I had a feeling you were going to say RTFM Patrick. Tnx I have already and will slowly work thru it. I just wondered if there was perhaps an easier way, perhaps using X, to do this on a SuSE 9.0 system.
The manual is more complete and a better reference than I am <grin>. You did not really ask specific questions and I would have to guess at your requirements.
One question already whilst reading the man pages, does logrotate have to be manually run or does it do its own thing with no setup from the user?
I tried:
linux:~ # logrotate -usage logrotate: bad argument -usage: unknown error
man logrotate says that it is normally run by a cron job. It is run on my 9.0 system automatically (I cannot find the cron entry) as installed, but I have added several log files that were not included; procmail, fetchmail, ...
How can I found out it has run recently without specifying a particular file because there is very little chance of me browsing /var/log/messages and looking for logrotate?
grep comes to mind. man logrotate says that the 'default state file' is /var/lib/logrotate/status. As you can see, every answer that I have given has come from the man file. The secret is looking for the information. I will be the first to admin that a great majority of the man files are next to worthless to someone who does not have some background, ie: college professor talking at graduate student level to an 8th grader. This is one of the biggest problems with the advance of linux. (And I consider myself a 3rd grader in linux schooling. I *did* graduate from High School, 1959). more questions, I will try to help. gud luk, -- Patrick Shanahan Registered Linux User #207535 http://wahoo.no-ip.org @ http://counter.li.org HOG # US1244711
The Thursday 2004-06-03 at 13:36 -0500, Patrick Shanahan wrote:
man logrotate says that it is normally run by a cron job. It is run on my 9.0 system automatically (I cannot find the cron entry) as installed, but I have added several log files that were not included; procmail, fetchmail, ...
Extrapolating from suse 8.2, it is run from '/etc/cron.daily/logrotate', which simply contains: /usr/sbin/logrotate /etc/logrotate.conf -- Cheers, Carlos Robinson
* Carlos E. R.
The Thursday 2004-06-03 at 13:36 -0500, Patrick Shanahan wrote:
man logrotate says that it is normally run by a cron job. It is run on my 9.0 system automatically (I cannot find the cron entry) as installed, but I have added several log files that were not included; procmail, fetchmail, ...
Extrapolating from suse 8.2, it is run from '/etc/cron.daily/logrotate', which simply contains:
/usr/sbin/logrotate /etc/logrotate.conf
As it is in my 9.0. Thanks Carlos <grin>, -- Patrick Shanahan Registered Linux User #207535 http://wahoo.no-ip.org @ http://counter.li.org HOG # US1244711
Patrick Shanahan wrote:
* Hylton Conacher (ZR1HPC)
[06-03-04 12:05]: Patrick Shanahan wrote:
man logrotate
I had a feeling you were going to say RTFM Patrick. Tnx I have already and will slowly work thru it. I just wondered if there was perhaps an easier way, perhaps using X, to do this on a SuSE 9.0 system.
How can I found out it has run recently...
.... is /var/lib/logrotate/status. THAT is the file I was looking for.It is actually /var/lib/logrotate.status
I assume this file, without having previously read the man page, is a listing of when each log file was last rotated? I think the man page is wrong giving /var/lib/logrotate/status as the status file when it is actually /var/lib/logrotate.status, or is there a misunderstanding on my part? You asked for more questions Patrick..... :) What happens to all the gzip'd log files, or do they just keep rolling over, keeping the same size but deleting the older log information? Would a maxage need to be put in each etc/logrotate.d file? I would assume that if I decide to add some of the options listed in the man page that all I need to do is add them into the /etc/logrotate.conf file to have them implemented on all the log files under logrotate.d control or do I need to add those options to each stanza of each file in /etc/logrotate? What to they mean removed, like deleted? Surely it should just continue to log and have the older entries trimmed from it? Can logrotate be instructed to do this type of logging via /etc/logrotate.conf? Can it be said that logrotate just snips and compresses logs? How does it do it ie how many lines/days of log entry are snipped from each log? -- ======================================================================== Hylton Conacher - Linux user # 229959 at http://counter.li.org Currently using SuSE 9.0 Professional with KDE 3.1 Licenced Windows user ========================================================================
* Hylton Conacher (ZR1HPC)
THAT is the file I was looking for.It is actually /var/lib/logrotate.status
I assume this file, without having previously read the man page, is a listing of when each log file was last rotated?
that is what appears to me.
I think the man page is wrong giving /var/lib/logrotate/status as the status file when it is actually /var/lib/logrotate.status, or is there a misunderstanding on my part?
agreed.
You asked for more questions Patrick..... :)
I am learning as much as you are here <grin>.
What happens to all the gzip'd log files, or do they just keep rolling over, keeping the same size but deleting the older log information?
from TFM: maxage count Remove rotated logs older than <count> days. The age is only checked if the log file is to be rotated. The files are mailed to the configured address if maillast and mail are configured.
Would a maxage need to be put in each etc/logrotate.d file?
as I read the man file, yes. There is /etc/logrotate.conf which appears to be a *default* configuration, but maxage is not there and I find no man file for logrotate.conf. From browsing /etc/logrotate.d/xxx, it appears that all parameters are presented separately for each entry.
I would assume that if I decide to add some of the options listed in the man page that all I need to do is add them into the /etc/logrotate.conf file to have them implemented on all the log files under logrotate.d control or do I need to add those options to each stanza of each file in /etc/logrotate?
see my previous answer above. When I add/alter entries, I look at the other entries and use what appears to fit my purpose.
What to they mean removed, like deleted? Surely it should just continue to log and have the older entries trimmed from it? Can logrotate be instructed to do this type of logging via /etc/logrotate.conf?
again, I find no documentation for logrotate.conf other that the file itself. Your guess would be as good as mine. Perhaps trial and error will provide an answer here. Looks like your call there as I have the operation, AFAICT, working properly. <grin>..
Can it be said that logrotate just snips and compresses logs? How does it do it ie how many lines/days of log entry are snipped from each log?
Again, from the man file and observation, it appears that compresses, if directed, and moves/renames the result so that your newer logs are written to a pristine file. Again, reading TFM gives you the same understanding, I believe, that it gives me. If nothing else, we will surly gain knowledge from this exchange. -- Patrick Shanahan Registered Linux User #207535 http://wahoo.no-ip.org @ http://counter.li.org HOG # US1244711 Photo Album: http://wahoo.no-ip.org/photos
The Saturday 2004-06-05 at 18:46 -0500, Patrick Shanahan wrote:
again, I find no documentation for logrotate.conf other that the file itself. Your guess would be as good as mine. Perhaps trial and error will provide an answer here. Looks like your call there as I have the operation, AFAICT, working properly. <grin>..
No? :-o See "man logrotate", section "CONFIGURATION FILE". It is all there, at least on mine. -- Cheers, Carlos Robinson
* Carlos E. R.
See "man logrotate", section "CONFIGURATION FILE". It is all there, at least on mine.
Agreed, no agrument. I read (past tense) that as the /etc/logrotate.d/<files>. -- Patrick Shanahan Registered Linux User #207535 http://wahoo.no-ip.org @ http://counter.li.org HOG # US1244711 Photo Album: http://wahoo.no-ip.org/photos
Patrick Shanahan wrote:
* Carlos E. R.
[06-06-04 19:47]: See "man logrotate", section "CONFIGURATION FILE". It is all there, at least on mine.
Agreed, no agrument. I read (past tense) that as the /etc/logrotate.d/<files>. mmm, time to bring Carlos into the friendly logrotate fray. Any others want to lend their SuSian advice? :)
Carlos tnks but although the man logrotate lists configuration options, it does not say that those are placed in /etc/log/logrotate.conf. Are you saying that all the files that need to be logrotated could be written into the /etc/logrotate.conf file as opposed to creating a new file in /etc/logrotate.d/ for each log to be rotated? That is certainly my interpretation of the man page. why then do the /etc/logrotate.d/ files need to be created? What is the difference between the two files(The /etc/logrotate.conf one and the /etc/logrotate.d/<log rotation file>). Which is considered Master authority? I would assume the .conf one but then why have all the other logrotating files in /etc/logrotate.d? I notice from the man page that it does mention that the .conf is a configuration file but it also states in the Configuration options that the below can be placed in EACH file to due Global options. It does not say what the function of the .conf file is? Checking on my 9.0 system I see that the .conf isn't even in the logrotate.d folder but in /etc. -- ======================================================================== Hylton Conacher - Linux user # 229959 at http://counter.li.org Currently using SuSE 9.0 Professional with KDE 3.1 Licenced Windows user ========================================================================
The Tuesday 2004-06-08 at 12:45 +0200, Hylton Conacher (ZR1HPC) wrote:
Agreed, no agrument. I read (past tense) that as the /etc/logrotate.d/<files>. mmm, time to bring Carlos into the friendly logrotate fray. Any others want to lend their SuSian advice? :)
Grumble, grumble... I was going to have some sleep now :-)
Carlos tnks but although the man logrotate lists configuration options, it does not say that those are placed in /etc/log/logrotate.conf. Are you saying that all the files that need to be logrotated could be written into the /etc/logrotate.conf file as opposed to creating a new file in /etc/logrotate.d/ for each log to be rotated? That is certainly my interpretation of the man page. why then do the /etc/logrotate.d/ files need to be created?
Is just a question of keeping order in our configuration files. It is easier for the packager (ie, SuSE) to create one file in '/etc/logrotate.d/' per rpm installed, than it would be to parse and edit '/etc/logrotate.conf' for each of them.
What is the difference between the two files(The /etc/logrotate.conf one and the /etc/logrotate.d/<log rotation file>). Which is considered Master authority? I would assume the .conf one but then why have all the other logrotating files in /etc/logrotate.d?
The master file is '/etc/logrotate.conf', that's the only one the program knows about at first. But notice that that file is almost empty, but it contains this line: include /etc/logrotate.d at that point, every file in that directory is included and parsed; if they contain options oposed to those in the master file, the new ones take precedence. -- Cheers, Carlos Robinson
Carlos E. R. wrote:
The Tuesday 2004-06-08 at 12:45 +0200, Hylton Conacher (ZR1HPC) wrote:
mmm, time to bring Carlos into the friendly logrotate fray. Any others want to lend their SuSian advice? :)
Carlos tnks but although the man logrotate lists configuration options, it does not say that those are placed in /etc/log/logrotate.conf. Are you saying that all the files that need to be logrotated could be written into the /etc/logrotate.conf file as opposed to creating a new file in /etc/logrotate.d/ for each log to be rotated? That is certainly my interpretation of the man page. why then do the /etc/logrotate.d/ files need to be created?
Is just a question of keeping order in our configuration files. Sri to keep you away from the bed and good women :)
So I could assume it is like a template file but slightly differently ie use me first and go where I say/report back to me to get the next command? Working toward a definition of logrotate then we could say that logrotate executes the commands in the .conf file on a regular user defined basis that normally leads it to other 'configuration' files in the logrotate.d folder which it follows.
It is easier for the packager (ie, SuSE) to create one file in '/etc/logrotate.d/' per rpm installed, than it would be to parse and edit '/etc/logrotate.conf' for each of them. mmm, I see where you are coming from.
What is the difference between the two files(The /etc/logrotate.conf one and the /etc/logrotate.d/<log rotation file>). Which is considered Master authority? I would assume the .conf one but then why have all the other logrotating files in /etc/logrotate.d?
The master file is '/etc/logrotate.conf', that's the only one the program knows about at first. But notice that that file is almost empty, but it contains this line:
include /etc/logrotate.d
at that point, every file in that directory is included and parsed; if they contain options oposed to those in the master file, the new ones take precedence. I know fully understand which file comes first and why there are all those other 'silly' log.d files however, I still do not know what logrotate is or does ie what does it to to the log file to consider it rotated? Does it execute the raguments in the /log.d file and then compress the files or does it just compress the file, or what?
I would assume the order of what to execute in the .conf file is important ie you don't want to compress log before they have been 'rotated'/actioned by their own log.d file? -- ======================================================================== Hylton Conacher - Linux user # 229959 at http://counter.li.org Currently using SuSE 9.0 Professional with KDE 3.1 Licenced Windows user ========================================================================
The Thursday 2004-06-10 at 15:38 +0200, Hylton Conacher (ZR1HPC) wrote:
I know fully understand which file comes first and why there are all those other 'silly' log.d files however, I still do not know what logrotate is or does ie what does it to to the log file to consider it rotated? Does it execute the raguments in the /log.d file and then compress the files or does it just compress the file, or what?
I would assume the order of what to execute in the .conf file is important ie you don't want to compress log before they have been 'rotated'/actioned by their own log.d file?
I don't fully know the details of how log rotate works, I'd have to read the man page very carefully for that. /var/log/warn /var/log/messages /var/log/allmessages /var/log/localmessages /var/log/firewall /var/l compress dateext maxage 365 rotate 99 missingok notifempty size +4096k create 640 root root sharedscripts postrotate /etc/init.d/syslog reload endscript } Those entries tell that those files will be compressed when they reach +4096k, to a new file with the date appended to the name. A new file will be created owned by root:root with permissions 640, and the syslog daemon will be restarted. Old copies are deleted after a year, but only 99 are kept (I think). Finally, /var/lib/logrotate.status seems to keep the date of the last time a file was rotated. That's all I need to know :-) -- Cheers, Carlos Robinson
Hylton Conacher (ZR1HPC) wrote:
I have been running SuSE 9.0 for about 6 months and while the system has never slowed down, I am beginning to think that with all the logging linux does, that the log files are getting a little large.
Am I right in saying that logrotate is already doing this or does it need to be set up/edited? If I browse /, I see there is a /etc/logrotated directory with various files in it, are these the only logs that are logrotated and can other files be placed in the directory by me, in the right format, and also get logrotated?
Is there a SuSE HOWTO on setting up logrotate files or is it done by the system from time to time. What do all the entries in each section mean ie if i wanted to change how often it does it, is there a number I can change?
There's the file (IIRC) /etc/logrotate.conf, that tells logrotate what logs to rotate. Check /var/log for huge files, which might indicate suitable candidates.
James Knott wrote:
Hylton Conacher (ZR1HPC) wrote:
I have been running SuSE 9.0 for about 6 months and while the system has never slowed down, I am beginning to think that with all the logging linux does, that the log files are getting a little large. [snip]
There's the file (IIRC) /etc/logrotate.conf, that tells logrotate what logs to rotate. Check /var/log for huge files, which might indicate suitable candidates. Thanks James. If I had just read the damn man page as Patrick suggested I would have seen that that is indeed the case.
Had a look through my /var/logs/ and didn't see anything over 200k that was aged ie not having been created today bar a couple of 2Mb messages<date>.gz files. -- ======================================================================== Hylton Conacher - Linux user # 229959 at http://counter.li.org Currently using SuSE 9.0 Professional with KDE 3.1 Licenced Windows user ========================================================================
* Hylton Conacher (ZR1HPC)
Thanks James. If I had just read the damn man page as Patrick suggested I would have seen that that is indeed the case.
That's where I am finding the information. I would assume that you would want the same. I have to look at the man pages to see if my understanding is on line and to make sure that I do not make statements/assumptions, although that is left open for interpretation. -- Patrick Shanahan Registered Linux User #207535 http://wahoo.no-ip.org @ http://counter.li.org HOG # US1244711 Photo Album: http://wahoo.no-ip.org/photos
participants (4)
-
Carlos E. R.
-
Hylton Conacher (ZR1HPC)
-
James Knott
-
Patrick Shanahan