Which file to edit to Rotate Logs -
Jerry
logrotate state -- version 2
"/var/log/security.log" 2004-5-16
"/var/log/rpmpkgs" 2004-5-16
"/var/log/sudo.log" 2003-11-7
"/var/log/auth.log" 2004-5-16
"/var/log/syslog" 2004-4-12
"/var/log/user.log" 2004-5-16
"/var/log/secure" 2004-5-16
"/var/log/messages" 2004-4-12
"/var/log/boot.log" 2004-5-16
"/var/log/mail/errors" 2004-5-16
"/var/log/mail/info" 2004-5-16
"/var/log/mail/warnings" 2004-5-16
"/var/log/cron/errors" 2004-5-16
"/var/log/cron/info" 2004-5-16
"/var/log/cron/warnings" 2004-5-16
"/var/log/kernel/errors" 2004-5-16
"/var/log/kernel/info" 2004-4-12
"/var/log/kernel/warnings" 2004-5-16
"/var/log/lpr/errors" 2004-5-16
"/var/log/lpr/info" 2004-5-16
"/var/log/lpr/warnings" 2004-5-16
"/var/log/news/news.err" 2004-5-16
"/var/log/news/news.notice" 2004-5-16
"/var/log/news/news.crit" 2004-5-16
"/var/log/daemons/errors" 2004-5-16
"/var/log/daemons/info" 2004-5-16
"/var/log/daemons/warnings" 2004-5-16
"/var/log/explanations" 2004-5-16
"/var/log/urpmi.log" 2004-5-16
"/var/log/xdm-error.log" 2003-11-7
"/var/log/wtmp" 2004-4-9
"/var/log/lastlog" 2004-5-16
It is obvious that these 4 files have not been reguarly rotated
for way too long. Because of this, I recently had a disk full problem
that would prevent me from logging into X.
"/var/log/syslog" 2004-4-12
"/var/log/kernel/info" 2004-4-12
"/var/log/wtmp" 2004-4-9
"/var/log/messages" 2004-4-12
My question is, if my /usr/lib/logrotate.conf looks like this...
# see "man logrotate" for details
# rotate log files weekly
weekly
# keep 4 weeks worth of backlogs
rotate 4
# create new (empty) log files after rotating old ones
create
# uncomment this if you want your log files compressed
compress
# RPM packages drop log rotation information into this directory
include /etc/logrotate.d
# no packages own lastlog or wtmp -- we'll rotate them here
/var/log/wtmp {
monthly
create 0664 root utmp
rotate 1
}
/var/log/lastlog {
monthly
rotate 1
}
# system-specific logs may be configured here
what should I edit to make sure these previously mentioned files are rotated
normally so I don't have another disk full problem?
I just want to make sure before I edit the wrong file.
jeraldw...@earthlink.net
> On 16 May 2004 08:34:43 -0700, Jerry wrote:
>
>> My question is, if my /usr/lib/logrotate.conf looks like this...
>
> Hmmm, logrotate.conf is in /etc/ not /usr/lib.
> What distribution and release level are your running.
Mandrake 9.2 (Torrent)
>
>> what should I edit to make sure these previously mentioned files are
>> rotated normally so I don't have another disk full problem?
>
> Since your file looks like mine, I'll guess your system needs to be
> left on Sunday mornings past 3am so the 4am batch jobs can do their thing.
>
> sys*
> -rw------- 1 root adm 79,556 May 16 10:01 syslog
> -rw------- 1 root adm 111,245 May 16 04:02 syslog.1.gz
> -rw------- 1 root adm 120,741 May 9 04:02 syslog.2.gz
> -rw------- 1 root adm 69,454 May 2 04:01 syslog.3.gz
>
> wtmp*
> -rw-r----- 1 root adm 403,968 May 16 10:04 wtm
> -rw-r----- 1 root adm 2,807 May 1 00:09 wtmp.1.gz
I'm not following :(
I was expecting a reply along the lines of
edit /etc/logrotate.conf for the four files in question
/var/log/syslog
...
...
...
Bit Twister
> I'm not following :(
Just wanted to show you that the files in question would rotate as normal
if the box was up when the cron job ran using the same logrotate.conf
file as yours.
> I was expecting a reply along the lines of
> edit /etc/logrotate.conf for the four files in question
> /var/log/syslog
Yes, I heard your question. Modifying the scrip will not help if your
machine is not running during the time the cron job would do the rotate.
You may want to look at the partition monitor daemon (partmon) to tell you when
you start getting low on space.
jeraldw...@earthlink.net
> On Sun, 16 May 2004 16:20:33 GMT, jeraldw...@earthlink.net wrote:
>
>> I'm not following :(
>
> Just wanted to show you that the files in question would rotate as normal
> if the box was up when the cron job ran using the same logrotate.conf
> file as yours.
Sure, I understand.
>> I was expecting a reply along the lines of
>> edit /etc/logrotate.conf for the four files in question
>> /var/log/syslog
>
> Yes, I heard your question. Modifying the scrip will not help if your
> machine is not running during the time the cron job would do the rotate.
So, if I modify the /etc/logrotate.conf file AND have the system running
at that time, it should run the script.
> You may want to look at the partition monitor daemon (partmon) to tell you
> when you start getting low on space.
Okay.
One other thing, when I'm not sure, but I think that after I command-lined
"/var/lib/logrotate.status"
the terminal hung and then I did a "df" and wow! almost 30% of that usage
evaporated for some strange reason. Have you ever had this happen
similarly?
Is this a script or something?
Bill Mullen
> It is obvious that these 4 files have not been reguarly rotated
> for way too long. Because of this, I recently had a disk full problem
> that would prevent me from logging into X.
> "/var/log/syslog" 2004-4-12
> "/var/log/kernel/info" 2004-4-12
> "/var/log/wtmp" 2004-4-9
> "/var/log/messages" 2004-4-12
> what should I edit to make sure these previously mentioned files are
> rotated normally so I don't have another disk full problem?
> I just want to make sure before I edit the wrong file.
Your system is probably not often on at 4 AM, when the cron.daily script
usually runs. Install the "anacron" RPM, and set the anacron service to
run at boot time. It will ensure that any missed jobs in the cron.daily,
cron.weekly, and cron.monthly groups get executed shortly after boot, if
the box wasn't running at the times that those jobs were last scheduled
to be run.
HTH!
--
Bill Mullen mo...@lunarhub.com MA, USA RLU #270075 MDK 8.1 & 9.0
"There are two kinds of people in the world, those who believe there are
two kinds of people in the world and those who don't." - Robert Benchley
jeraldw...@earthlink.net
> On 16 May 2004 08:34:43 -0700, Jerry sputtered:
>
>
>> It is obvious that these 4 files have not been reguarly rotated
>> for way too long. Because of this, I recently had a disk full problem
>> that would prevent me from logging into X.
>
>> "/var/log/syslog" 2004-4-12
>> "/var/log/kernel/info" 2004-4-12
>> "/var/log/wtmp" 2004-4-9
>> "/var/log/messages" 2004-4-12
>
>> what should I edit to make sure these previously mentioned files are
>> rotated normally so I don't have another disk full problem?
>
>> I just want to make sure before I edit the wrong file.
>
> Your system is probably not often on at 4 AM, when the cron.daily script
> usually runs. Install the "anacron" RPM, and set the anacron service to
> run at boot time. It will ensure that any missed jobs in the cron.daily,
> cron.weekly, and cron.monthly groups get executed shortly after boot, if
> the box wasn't running at the times that those jobs were last scheduled
> to be run.
>
> HTH!
Yes, thanks. In my googling I had gleaned something in regards to
anacron. I found it on disk 3 (Intl). Just popped it in and it's
now happily rotating large disk-filling log files.
Thanks again.
Bit Twister
> So, if I modify the /etc/logrotate.conf file AND have the system running
> at that time, it should run the script.
Yes, you can test with ./script_name_here but remember in this case,
logrotate may not do what you expect because the required amount of
time may not have elasped.
> One other thing, when I'm not sure, but I think that after I command-lined
>
> "/var/lib/logrotate.status"
No idea what you mean. Just doing a /var/lib/logrotate.status should
have given you an error because normally execuit perm is not set. See
/var/lib/logrotate.status
-bash: /var/lib/logrotate.status: Permission denied
> the terminal hung and then I did a "df" and wow! almost 30% of that usage
> evaporated for some strange reason.
You can have applications which open/delete files in between your df
so see size jumps does not bother me too much. Some scripts copy a file
from here to there which would double space used, then delete the
original freeing up the space.
> Is this a script or something?
No it is a log. When in doubt, always do a less filename_here to see
what will happen.
If you did manage to execute the /var/lib/logrotate.status your shell
would try to execute each line found in the file. It should have
complained about each line.
Scripts are nothing more than commands that can be issued at the
command line. You can try info or man command_here to see what it would do.
For more information about bash scripting
http://www.tldp.org/LDP/abs/html/index.html