[clug] rotating log files

[Matthew Oliver]

One advantage of logrotate is you can rotate at a certain size rather 
then date, or both.
You can tell it to rotate when a log gets to a certain size, and then 
even compress each of the old rotated logs.

The advantage of this is it means you can calculate the maximum size of 
logs, but you only keep a moving window of time, based upon the amount 
of logs rather then time.
I guess that's when backups come in handy.

I guess another advantage of this is it means if someone decided to 
attempt to do a possible DOS by filling your /var partition (tho this 
could take a while with disk sizes they are now) it wouldn't work cause 
logrotate is only keeping so much. Tho again this could be bad as you'd 
lose your older logs that could be important.

Maybe that's why rotating could be beneficial. If named correctly :)

Anyway, there my 2 cents.

Matt

Robert Edwards wrote:
>
> Can anyone suggest to me why rotating log files would ever be
> considered a "Good Idea"?
>
> Most distros come with a utility "logrotate" configured to
> rename a whole bunch of log files each day/week/month (configurable).
>
> To me, a much better approach would be to date-stamp each of the
> log files each day/week/month (configurable) and not to rotate the
> file names.
>
> Does such an alternative exist (before we write our own)? What should
> I search for?
>
> Why do I care? Our backup server makes archive copies of each file
> that is deleted or modified. In the case of rotating log files, each
> log file gets archived each day/week/month as its name is changed.
> We really only need/want one copy of the log file in the archive.
>
> Also, determining which log file is relevant for, say, last Tuesday
> means counting backwards in the case of rotating log files, but in
> the case of date-stamped log files, is simply a matter of looking in
> the file with the relevant date stamp (maybe the date stamp for the
> day after).
>
> Just wondering out loud, before sitting down to some coding.
>
> Bob Edwards.