Log Rotation Tool/Script

Shell Programming and Scripting
1

Hello all

Does anyone has an intersting script or a good freeware tool for log rotation that is good for Unix and Linux as well ?

My thanks in advance

2

all you need to do is check the file size and or date of the log you want to rotate.

@log=qw(/var/adm/messages /var/log/syslog);
if (file to big || is not from today) {then move it or something;}

its actually alot easier then it might sound.
post where you are stuck.

linux and any enterprise OS should have something to rotate the logs automaticly via cron.

3

It does depend on whether a given logfile is actually being closed by the process that is writing to it. Programs that write to logfiles often keep the file descriptors open for their logfiles. The file descriptor refers to the inode on the filesystem, so removing/moving a file within a filesystem will mean the process will continues to write to the renamed file.

If the file is removed the kernel is merely unlinking it from a directory, but because the file descriptor referring to it still exists, the file itself can still be written to.

Typically you get a syslog daemon to close its file-descriptors by
sending a HUP to it, although this is mere convention.

You can look at: http://iain.cx/src/logrotate/ - most Linux flavors come with a logrotate script in place already.

Just a case in point:

Looking at syslog:
# ls -l syslog
-rw-r--r-- 1 root other 5078349 Dec 10 22:54 syslog

What process has it open:
# fuser -u syslog
syslog: 26317o(root)

Move the file:
# mv syslog syslog.20031210

Inode is still associated with the new file and held open by the process:
# fuser -u syslog.20031210
syslog.20031210: 26317o(root)

Syslog will keep writing to syslog.20031210 until a HUP (kill -HUP) is sent to syslog (only works under some flavors of unix), or syslog is restarted.

Cheers,

Keith

4

I kinda like newsyslog.

5

Here is a link to a thread where we came up with a perl solution for automagic log rotating based upon number of entries. This by-passes syslogd so it might or might not be useful to you.

http://www.freebsdforums.org/forums/showthread.php?postid=13949\#post13949

The perl code is as follows:

#!/usr/bin/perl

# Real cheezy attempt at piping STDOUT into a perl routine to automagically
# rotate logs. Idea inspired by cRock.
# Auswipe sez "Hey, no guarantees!"

my $lineCounter = 0;
my $logCount    = 1;

#open(LOGFILE, ">app.log.$logCount");

while (true) {
  if (($lineCounter > 1000) || ($lineCounter == 0)) {
    close(LOGFILE);
    open(LOGFILE, ">app.log.$logCount");
    $logCount++;
    $lineCounter = 1;
    # print STDERR "Rolled log to app.log.$logCount\n";
  };
  $logEntry = <STDIN>;
  $lineCounter++;
  print LOGFILE "$logEntry";
  #print STDERR "Made log entry.\n";
};

Sample usage:

./someapp | ./perl_buffer