Adjusting Logrotate and Lessons Learned Redux

A syntax error in a logrotate configuration file was breaking Apache for me. So I dug into the logrotate man page and made some other changes to my logrotate strategy, including date stamping files when they are rotated. This is the logrotate configuration for my Apache virtual hosts.

Apache logoBack in October I had some issues with logs and adjusted logrotate. This weekend I made additional changes while killing some website bugs and resolving annoyances.

By default logrotate appends a numeral to the file name as it’s rotated. (At least on Debian 6). There is a configuration file parameter dateeext that will append the date instead.  There’s also a parameter dateformat if the default extension isn’t suitable.

I also had an issue where logrotate failed when I deleted a test website but didn’t update the logrotate configuration to remove its logs. I added the missingok configuration parameter to handle this in the future.

I also changed logrotate to rotate files weekly or when the size exceeds 100MB. I’ll see how this works out and adjust it if needed.

I also had a self-inflicted wound where I left out the opening curly bracket. This caused it to rotate apache2ctl, causing my apache problems. I was probably sloppy in my testing and made a quick change after testing and somehow deleted the bracket.

To test logrotate the command: sudo /usr/sbin/logrotate -vfd /etc/logrotate.d/config_file_to_test can be used. The –vfd switch means to run in verbose mode, force logrotate even if it’s  not needed, and run in debug mode. Debug mode means no logs will actually be rotated. Sudo is not needed if logged on as the root user.

The file /var/lib/logrotate/status is logrotates memory of when files were last rotated. Deleting a file’s entry from here will force it to be acted upon the next time logrotate runs. It’s also a good place to see what files are being rotated.

So, the logrotated configuration for my websites is now:

rotate 5
size 100M
/usr/sbin/apache2ctl graceful > /dev/null

This rotates the logs weekly (or when the reach 100MB) and saves the last 5 logs. I experimented with mailing the logs when it came time to delete them but decided it would be too many emails and it would be easier for me to grab the files once a month. I may increase from 5 the number of logs I save to give me some extra time to grab them.