[clug] rotating log files

[Kim Holburn]

I have  used a script for years that renames log files with a date  
stamp, on systems that have no dateext option.  The problem with a  
script run by the postrotate command in logrotate is that it doesn't  
seem to have a way of getting to the file name.  This is no problem  
if each file has a section in the logrotate configuration.  If you  
have a catchall section or a section that covers a number of log  
files then the script can't work.


On 2007/Mar/23, at 3:23 AM, Robert Edwards wrote:

> Matthew Oliver wrote:
>> One advantage of logrotate is you can rotate at a certain size  
>> rather then date, or both.
>> You can tell it to rotate when a log gets to a certain size, and  
>> then even compress each of the old rotated logs.
>
> This could also be done with time/date stamping, or with a simple
> increasing serial number. I still can't see the sense in renaming all
> the previous log files.

I think the origins of logrotate come from a time when disks were  
smaller and more expensive and it remains becuase some systems like  
embedded systems need a simple log rotation system that will work in  
a very limited environment.

>
> Cheers,
>
> Bob Edwards.
>
>> The advantage of this is it means you can calculate the maximum  
>> size of logs, but you only keep a moving window of time, based  
>> upon the amount of logs rather then time.
>> I guess that's when backups come in handy.
>> I guess another advantage of this is it means if someone decided  
>> to attempt to do a possible DOS by filling your /var partition  
>> (tho this could take a while with disk sizes they are now) it  
>> wouldn't work cause logrotate is only keeping so much. Tho again  
>> this could be bad as you'd lose your older logs that could be  
>> important.
>> Maybe that's why rotating could be beneficial. If named correctly :)
>> Anyway, there my 2 cents.
>> Matt
>> Robert Edwards wrote:
>>>
>>> Can anyone suggest to me why rotating log files would ever be
>>> considered a "Good Idea"?
>>>
>>> Most distros come with a utility "logrotate" configured to
>>> rename a whole bunch of log files each day/week/month  
>>> (configurable).
>>>
>>> To me, a much better approach would be to date-stamp each of the
>>> log files each day/week/month (configurable) and not to rotate the
>>> file names.
>>>
>>> Does such an alternative exist (before we write our own)? What  
>>> should
>>> I search for?
>>>
>>> Why do I care? Our backup server makes archive copies of each file
>>> that is deleted or modified. In the case of rotating log files, each
>>> log file gets archived each day/week/month as its name is changed.
>>> We really only need/want one copy of the log file in the archive.
>>>
>>> Also, determining which log file is relevant for, say, last Tuesday
>>> means counting backwards in the case of rotating log files, but in
>>> the case of date-stamped log files, is simply a matter of looking in
>>> the file with the relevant date stamp (maybe the date stamp for the
>>> day after).
>>>
>>> Just wondering out loud, before sitting down to some coding.
>>>
>>> Bob Edwards.
>
> -- 
> linux mailing list
> linux at lists.samba.org
> https://lists.samba.org/mailman/listinfo/linux

--
Kim Holburn
IT Network & Security Consultant
Ph: +39 06 855 4294  M: +39 3494957443
mailto:kim at holburn.net  aim://kimholburn
skype://kholburn - PGP Public Key on request

Democracy imposed from without is the severest form of tyranny.
                           -- Lloyd Biggle, Jr. Analog, Apr 1961