confirming logrotate has occured
Hi, I would like to check my system is logrotating as I cannot have the partition it is outgrow the HDD. How would I check, besides viewing the cron_daily etc scripts, that the logrotated had run and compressed any of my logs? Tnx P.S.: Anything besides 'man logrotate' Pat? -- The Little Helper ======================================================================== Hylton Conacher - Linux user # 229959 at http://counter.li.org Currently using SuSE 9.0 Professional with KDE 3.1 Licenced Windows user ========================================================================
Hylton Conacher (ZR1HPC) wrote:
Hi,
I would like to check my system is logrotating as I cannot have the partition it is outgrow the HDD.
How would I check, besides viewing the cron_daily etc scripts, that the logrotated had run and compressed any of my logs?
Tnx P.S.: Anything besides 'man logrotate' Pat?
Check your /var/log directory. You should see multiple versions of rotated files.
Hylton Conacher (ZR1HPC) wrote:
I would like to check my system is logrotating as I cannot have the partition it is outgrow the HDD.
How would I check, besides viewing the cron_daily etc scripts, that the logrotated had run and compressed any of my logs?
Check your /var/log directory. You should see multiple versions of rotated files. mmm, I do see a few <logfilename>-<date>.gz files. I would assume that
James Knott wrote: Thanks James, these are also deleted by the 'rotate' option in /etc/logrotate.conf but I see that I have files there from Jan and yet rotate in the above file is set to 4 ? (Tnx Pat you got me to look at the man page :) ) -- The Little Helper ======================================================================== Hylton Conacher - Linux user # 229959 at http://counter.li.org Currently using SuSE 9.0 Professional with KDE 3.1 Licenced Windows user ========================================================================
* Hylton Conacher (ZR1HPC) <hylton@global.co.za> [08-30-04 04:02]:
How would I check, besides viewing the cron_daily etc scripts, that the logrotated had run and compressed any of my logs?
...
P.S.: Anything besides 'man logrotate' Pat?
:^) why not look at the config files for logrotate and see which files should have compression/rotation performed, then display the directories where those files exist? ie: partial view of /etc/logrotate.d/syslog /var/log/warn /var/log/messages /var/log/allmessages /var/log/localmessages /var/log/firewall { compress dateext maxage 365 rotate 99 missingok notifempty size +4096k create 640 root root sharedscripts postrotate /etc/init.d/syslog reload endscript } so logrotate/digest will perform on /var/log/warn, /var/log/messages.... so on commandline or in your file browser of choice look in /var/log for warn* In my system I see (abreviated): /var/log/warn ..... /var/log/warn-20040814.gz /var/log/warn-20040817.gz /var/log/warn-20040819.gz /var/log/warn-20040821.gz /var/log/warn-20040824.gz /var/log/warn-20040825.gz /var/log/warn-20040827.gz so I may conclude that files are being condensed/compressed and rotated. Now, that wasn't so hard, was it? The thing to learn is not what was done, but how it was approached. :^) ps: man logrotate *is* the correct answer. If you will look in man logrotate, for 'CONFIGURATION FILE', you will see an example of what I just went thru and an explanation. Man files may be somewhat obtuse, but a quick scan, then a more cursory look at the particular items that appear to apply, *usually* will give enough direction to solve a problem or, at least, give understanding. NOTE: The manner you posed your question deserved the *long* explanation rather than the exemplary 'RTFM'. -- Patrick Shanahan Registered Linux User #207535 http://wahoo.no-ip.org @ http://counter.li.org HOG # US1244711 Photo Album: http://wahoo.no-ip.org/photos
Patrick Shanahan wrote:
* Hylton Conacher (ZR1HPC) <hylton@global.co.za> [08-30-04 04:02]:
How would I check, besides viewing the cron_daily etc scripts, that the logrotated had run and compressed any of my logs? ...
P.S.: Anything besides 'man logrotate' Pat?
:^)
why not look at the config files for logrotate and see which files should have compression/rotation performed, then display the directories where those files exist? ie:
partial view of /etc/logrotate.d/syslog
/var/log/warn /var/log/messages /var/log/allmessages /var/log/localmessages /var/log/firewall { compress dateext maxage 365 rotate 99 missingok notifempty size +4096k create 640 root root sharedscripts postrotate /etc/init.d/syslog reload endscript }
so logrotate/digest will perform on /var/log/warn, /var/log/messages.... Thanks Pat. Now I see a little clearer on the log file issue. So if I wanted to add another system log file to be rotated like the ones already listed how do I decide on which I should just add into the /etc/logrotate.d/syslog file?
so on commandline or in your file browser of choice look in /var/log for warn*
In my system I see (abreviated):
/var/log/warn ..... I got a fortune of wtmp.gz files that go way back to Jan 2004. I tried using OOo to view the ungzipped wtmp file but got 34 pages of rubbish. To get rid of the number of wtmp files held, where do I edit the 'maxage' option as I do not see a /var/log/wtmp entry in the /var/log/syslog file. Should I rather edit the maxage of the /etc/logrotate.d/wtmp file??
so I may conclude that files are being condensed/compressed and rotated.
Now, that wasn't so hard, was it? The thing to learn is not what was done, but how it was approached.
I have to admit with your explanation and a bit of man reading the log file rotation is a little clearer to me. :) Now it wasn't so hard, was it? To provide a substantial answer to my question as opposed to 'man logrotate', eventhough it was the ps answer. :) Thanks very much Pat
NOTE: The manner you posed your question deserved the *long* explanation rather than the exemplary 'RTFM'.
NOTE: The long manner you answered the question rather than the 'RTFM' was appreciated. -- The Little Helper ======================================================================== Hylton Conacher - Linux user # 229959 at http://counter.li.org Currently using SuSE 9.0 Professional with KDE 3.1 Licenced Windows user ========================================================================
* Hylton Conacher (ZR1HPC) <hylton@global.co.za> [08-31-04 12:16]:
Now I see a little clearer on the log file issue. So if I wanted to add another system log file to be rotated like the ones already listed how do I decide on which I should just add into the /etc/logrotate.d/syslog file?
the files you place in /etc/logrotate.d/ are expected by the system to be files for logrotate/logdigest to act on. Open several of the files and look at their contents. Read the man page for an explanation and examples of use of the different parameters.
I got a fortune of wtmp.gz files that go way back to Jan 2004. I tried using OOo to view the ungzipped wtmp file but got 34 pages of rubbish. To get rid of the number of wtmp files held, where do I edit the 'maxage' option as I do not see a /var/log/wtmp entry in the /var/log/syslog file. Should I rather edit the maxage of the /etc/logrotate.d/wtmp file??
edit the maxage paramter in /etc/logrotat.d/wtmp, it is in daz. .... Each of the files in /etc/logrotate.d/ should contain the 'maxage' parameter. If not, they will never be deleted.
NOTE: The long manner you answered the question rather than the 'RTFM' was appreciated.
But, if you reread the post, RTFM *was* what I said, buttered up a little. :^) You took the time and made effort to help yourself and were provided assistance and are learning from it. You will be able to do the same thing in another situation (if you think about it the same way) in the future and can provide help to others. gud luk, -- Patrick Shanahan Registered Linux User #207535 http://wahoo.no-ip.org @ http://counter.li.org HOG # US1244711 Photo Album: http://wahoo.no-ip.org/photos
On Tuesday 31 August 2004 01:48 pm, Patrick Shanahan wrote:
the files you place in /etc/logrotate.d/ are expected by the system to be files for logrotate/logdigest to act on. Open several of the files and look at their contents. Read the man page for an explanation and examples of use of the different parameters.
I got a fortune of wtmp.gz files that go way back to Jan 2004.
OK, jumping in on this thread, I also have a gazillion files in /var/log/ such as localmessage, mail, messages , and various XF86 files, some going back to early 2003. Now, none of these are listed in the /etc/logrotate.d/ directory. Can I just add these categories to that directory by making new files?
edit the maxage paramter in /etc/logrotat.d/wtmp, it is in daz.
.... Each of the files in /etc/logrotate.d/ should contain the 'maxage' parameter. If not, they will never be deleted.
Bob S.
On Wednesday 01 September 2004 00:28, Bob S. wrote:
I got a fortune of wtmp.gz files that go way back to Jan 2004.
OK, jumping in on this thread, I also have a gazillion files in /var/log/ such as localmessage, mail, messages , and various XF86 files, some going back to early 2003. Now, none of these are listed in the /etc/logrotate.d/ directory. Can I just add these categories to that directory by making new files?
Sure. That's what I do on my mailserver. With all the domains we host, qmail, qmail-scanner and clamav tend to be generous with the logs after getting hammered with spam and viruses. I have to rotate those, as well as the firewall logs, hourly. The files in /etc/logrotate.d/ are good working examples, and don't forget that "man logrotate" is your friend. -- Homepage http://scott.exti.net XFce desktop environment http://www.xfce.org Goodies for the XFce desktop http://xfce-goodies.berlios.de GPG public key ID: 811B00AB
On Wednesday 01 September 2004 02:16, Scott Jones wrote:
On Wednesday 01 September 2004 00:28, Bob S. wrote:
I got a fortune of wtmp.gz files that go way back to Jan 2004.
OK, jumping in on this thread, I also have a gazillion files in /var/log/ such as localmessage, mail, messages , and various XF86 files, some going back to early 2003. Now, none of these are listed in the /etc/logrotate.d/ directory. Can I just add these categories to that directory by making new files?
Sure. That's what I do on my mailserver. With all the domains we host, qmail, qmail-scanner and clamav tend to be generous with the logs after getting hammered with spam and viruses. I have to rotate those, as well as the firewall logs, hourly.
The files in /etc/logrotate.d/ are good working examples, and don't forget that "man logrotate" is your friend.
-- Homepage http://scott.exti.net XFce desktop environment http://www.xfce.org Goodies for the XFce desktop http://xfce-goodies.berlios.de GPG public key ID: 811B00AB I'm just a little puzzled. The 'logrotate.conf' file has the following: # see "man logrotate" for details # rotate log files weekly weekly
# keep 4 weeks worth of backlogs rotate 4 ...and the /etc/logrotate.d/syslog contains: /var/log/warn /var/log/messages /var/log/allmessages /var/log/localmessages / var/log/firewall { compress dateext maxage 365 rotate 99 missingok notifempty size +4096k create 640 root root sharedscripts postrotate /etc/init.d/syslog reload endscript ...which seems to be contradictory. I have done 'man logrotate' & the 'maxage' seems nowhere in the docs. Some time back, I finally put '--force' in the logrotate script so that they'd be archived daily. Still, I have had to manually mv logs out of /var/log because they're not rotating at all. -- ..."Yogi" CH Namasté Yoga Studio "If music be the food of love, why can't rabbits sing?"
* C Hamel <yogich@sc2000.net> [09-01-04 07:51]:
I'm just a little puzzled. The 'logrotate.conf' file has the following: # see "man logrotate" for details # rotate log files weekly weekly
# keep 4 weeks worth of backlogs rotate 4 ...and the /etc/logrotate.d/syslog contains: /var/log/warn /var/log/messages /var/log/allmessages /var/log/localmessages / var/log/firewall { compress dateext maxage 365 rotate 99 missingok notifempty size +4096k create 640 root root sharedscripts postrotate /etc/init.d/syslog reload endscript ...which seems to be contradictory. I have done 'man logrotate' & the 'maxage' seems nowhere in the docs. Some time back, I finally put '--force' in the logrotate script so that they'd be archived daily. Still, I have had to manually mv logs out of /var/log because they're not rotating at all.
from logrotate man page maxage count Remove rotated logs older than <count> days. The age is only checked if the log file is to be rotated. The files are mailed to the configured address if mail last and mail are configured. If you want the files rotated daily, instead of using '--force', why don't you set the parameter to 'daily' in /etc/logrotate.d/syslog? Above you have:
I'm just a little puzzled. The 'logrotate.conf' file has the following: # see "man logrotate" for details # rotate log files weekly weekly
# keep 4 weeks worth of backlogs rotate 4
rotate count Log files are rotated <count> times before being removed or mailed to the address specified in a mail directive. If count is 0, old versions are removed rather then rotated. rotate is based on '# of times' and maxage on '# of days' -- Patrick Shanahan Registered Linux User #207535 http://wahoo.no-ip.org @ http://counter.li.org HOG # US1244711 Photo Album: http://wahoo.no-ip.org/photos
On Wednesday 01 September 2004 08:27, Patrick Shanahan wrote: <SNIP>
from logrotate man page maxage count Remove rotated logs older than <count> days. The age is only checked if the log file is to be rotated. The files are mailed to the configured address if mail last and mail are configured.
If you want the files rotated daily, instead of using '--force', why don't you set the parameter to 'daily' in /etc/logrotate.d/syslog?
Above you have:
I'm just a little puzzled. The 'logrotate.conf' file has the following: # see "man logrotate" for details # rotate log files weekly weekly
# keep 4 weeks worth of backlogs rotate 4
rotate count Log files are rotated <count> times before being removed or mailed to the address specified in a mail directive. If count is 0, old versions are removed rather then rotated.
rotate is based on '# of times' and maxage on '# of days' -- Patrick Shanahan Registered Linux User #207535 http://wahoo.no-ip.org @ http://counter.li.org HOG # US1244711 Photo Album: http://wahoo.no-ip.org/photos Thanks! I don't know how I missed the 'maxcount'... but I did. Now, it is making a little more sense. :-) -- ..."Yogi" CH Namasté Yoga Studio "If music be the food of love, why can't rabbits sing?"
participants (6)
-
Bob S. -
C Hamel -
Hylton Conacher (ZR1HPC) -
James Knott -
Patrick Shanahan -
Scott Jones