From owner-freebsd-questions@FreeBSD.ORG Wed Aug 20 14:39:47 2008 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 6E6651065673 for ; Wed, 20 Aug 2008 14:39:47 +0000 (UTC) (envelope-from jalmberg@identry.com) Received: from mx1.identry.com (on.identry.com [66.111.0.194]) by mx1.freebsd.org (Postfix) with ESMTP id DE2598FC2C for ; Wed, 20 Aug 2008 14:39:46 +0000 (UTC) (envelope-from jalmberg@identry.com) Received: (qmail 71877 invoked by uid 89); 20 Aug 2008 14:39:46 -0000 Received: from unknown (HELO ?192.168.1.110?) (jalmberg@75.127.142.66) by mx1.identry.com with ESMTPA; 20 Aug 2008 14:39:46 -0000 Mime-Version: 1.0 (Apple Message framework v752.3) To: freebsd-questions@freebsd.org Message-Id: References: <27623D32-6BC7-4DC9-92F3-816A6F182EE8@identry.com> From: John Almberg Date: Wed, 20 Aug 2008 10:39:42 -0400 X-Mailer: Apple Mail (2.752.3) Content-Type: text/plain; charset=US-ASCII; delsp=yes; format=flowed Content-Transfer-Encoding: 7bit X-Content-Filtered-By: Mailman/MimeDel 2.1.5 Subject: Fwd: rotatelogs is rotating too quickly... X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 20 Aug 2008 14:39:47 -0000 On Aug 20, 2008, at 10:09 AM, Riaan Kruger wrote: > > > On Wed, Aug 20, 2008 at 4:03 PM, John Almberg > wrote: > That does not look like 5 Meg but 5 Minutes. > > > I don't think so... From the man pages: > > CustomLog "|bin/rotatelogs /var/logs/logfile 5M" common > > This configuration will rotate the logfile whenever it > reaches a size > of 5 megabytes. > > ErrorLog "|bin/rotatelogs /var/logs/errorlog.%Y-%m-%d-%H_ > %M_%S 5M" > > This configuration will rotate the error logfile whenever it > reaches a > size of 5 megabytes, and the suffix to the logfile name will > be created > of the form errorlog.YYYY-mm-dd-HH_MM_SS. > > > > Oops sorry. Didn't look close. Initial "inspection" of log file > times looked like 5 mins. > NP. That was my first thought, too, even though I had copied the line right out of the man pages. I had to read it again to make sure. Unfortunately, it's more complex than that... check out this list: > ls -lt nes* -rw-r--r-- 1 root wheel 35846 Aug 20 10:19 nes.com-access.log. 2008-08-20-12_40_09 -rw-r--r-- 1 root wheel 10117 Aug 20 10:01 nes.com-access.log. 2008-08-20-13_56_42 -rw-r--r-- 1 root wheel 284 Aug 20 08:37 nes.com-access.log. 2008-08-20-12_36_56 -rw-r--r-- 1 root wheel 204 Aug 20 08:34 nes.com-access.log. 2008-08-20-12_34_25 -rw-r--r-- 1 root wheel 181 Aug 20 08:31 nes.com-access.log. 2008-08-20-12_31_35 -rw-r--r-- 1 root wheel 181 Aug 20 08:29 nes.com-access.log. 2008-08-20-12_28_44 -rw-r--r-- 1 root wheel 204 Aug 20 08:26 nes.com-access.log. 2008-08-20-12_26_15 -rw-r--r-- 1 root wheel 195 Aug 20 08:24 nes.com-access.log. 2008-08-20-12_24_24 -rw-r--r-- 1 root wheel 204 Aug 20 08:21 nes.com-access.log. 2008-08-20-12_20_58 -rw-r--r-- 1 root wheel 5147 Aug 20 08:19 nes.com-access.log. 2008-08-20-12_19_25 Note the first two files on the list... the second file was created *after* the first one, but the first one is newer. That is because Apache is now logging to the first one, again. In other words, 1. it stopped logging to nes.com-access.log.2008-08-20-12_36_56, and created nes.com-access.log.2008-08-20-12_40_09 2. logged to that for awhile, then created nes.com-access.log. 2008-08-20-13_56_42 3. logged to that for awhile, and then *went back* to logging to nes.com-access.log.2008-08-20-12_40_09 I verified this by inspecting the two files and checking the times in the log. For example, these lines in nes.com-access.log. 2008-08-20-12_40_09 74.15.67.21 - - [20/Aug/2008:09:56:35 -0400] "GET /favicon.ico HTTP/ 1.1" 200 20 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)" 66.249.71.139 - - [20/Aug/2008:09:57:16 -0400] "GET /browse_item.html? category_id=117&item_id=1039&page=12 HTTP/1.1" 200 2806 "-" "Mozilla/ 5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" And these lines in nes.com-access.log.2008-08-20-13_56_42 74.15.67.21 - - [20/Aug/2008:09:56:42 -0400] "GET /payment/form/ HTTP/ 1.1" 200 2348 "http://www.newenglandstamp.com/" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)" 74.15.67.21 - - [20/Aug/2008:09:56:42 -0400] "GET /stylesheets/ public.css HTTP/1.1" 200 1416 "https://www.newenglandstamp.com/ payment/form/" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)" Note that the time stamps in the second set are *between* the two lines in the first set. i.e., Apache was logging to one file, then switched to another, and then switched back... As I said, I'm a newbie, but this seems a bit odd to me... -- John ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Websites for On-line Collectible Dealers ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Identry, LLC John Almberg (631) 546-5079 jalmberg@identry.com www.identry.com ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~