From owner-freebsd-questions@FreeBSD.ORG Fri Jan 4 22:13:17 2008 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 1119B16A419 for ; Fri, 4 Jan 2008 22:13:17 +0000 (UTC) (envelope-from walt@wump.org) Received: from que03.charter.net (que03.charter.net [209.225.8.191]) by mx1.freebsd.org (Postfix) with ESMTP id C586F13C4DD for ; Fri, 4 Jan 2008 22:13:16 +0000 (UTC) (envelope-from walt@wump.org) Received: from aarprv04.charter.net ([10.20.200.74]) by mtao02.charter.net (InterMail vM.7.08.03.00 201-2186-126-20070710) with ESMTP id <20080104214254.QWDB27011.mtao02.charter.net@aarprv04.charter.net> for ; Fri, 4 Jan 2008 16:42:54 -0500 Received: from [10.0.0.10] (really [68.116.98.9]) by aarprv04.charter.net with ESMTP id <20080104214253.SRLZ17353.aarprv04.charter.net@[10.0.0.10]> for ; Fri, 4 Jan 2008 16:42:53 -0500 Mime-Version: 1.0 Message-Id: Date: Fri, 4 Jan 2008 13:42:41 -0800 To: FreeBSD Questions From: Walt Pawley Content-Type: text/plain; charset="us-ascii" X-Chzlrs: 0 Subject: Log archiving question X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 04 Jan 2008 22:13:17 -0000 Once upon a time I messed with FreeBSD rather frequently. Then things changed. Time passed and I'm back to tinkering with things a little, though mostly from the perspective of a Mac OS X user. In that distant past, I found that "rotating" log files in the classical manner - changing the number and dropping any log needing another digit - did not preserve data that was needed to work on some of the problems we were seeing. So, I changed the way "rotating" was done to never delete the logs in question, instead naming the archived file uniquely with a time code. Here's an example of such a modification for Mac OS X Jaguar (a bit out of date but I use it 24/7) to deal with its equivalent of /var/log/messages. It's offered just to show the nature of the results. -- echo "" echo -n "Rotating log files:"0 cd /var/log for i in system.log; do if [ -f "${i}" ]; then echo -n " ${i}" if [ -x /usr/bin/gzip ]; then gzext=".gz"; else gzext=""; fi if [ -f "${i}.6${gzext}" ]; then mv -f "${i}.6${gzext}" "${i}.7${gzext}"; fi if [ -f "${i}.5${gzext}" ]; then mv -f "${i}.5${gzext}" "${i}.6${gzext}"; fi if [ -f "${i}.4${gzext}" ]; then mv -f "${i}.4${gzext}" "${i}.5${gzext}"; fi if [ -f "${i}.3${gzext}" ]; then mv -f "${i}.3${gzext}" "${i}.4${gzext}"; fi if [ -f "${i}.2${gzext}" ]; then mv -f "${i}.2${gzext}" "${i}.3${gzext}"; fi if [ -f "${i}.1${gzext}" ]; then mv -f "${i}.1${gzext}" "${i}.2${gzext}"; fi if [ -f "${i}.0${gzext}" ]; then mv -f "${i}.0${gzext}" "${i}.1${gzext}"; fi # if [ -f "${i}" ]; then mv -f "${i}" "${i}.0" && if [ -x /usr/bin/gzip ]; then gzip -9 "${i}.0"; fi; fi # touch "${i}" && chmod 640 "${i}" && chown root:admin "${i}" # 23 Sep 2007 1342 # Modification to keep system.log files by date rather than rotating them # NOTE: no provision for deleting the accumulation is provided!!!! X=$(date|awk '{print 0$3$2$6}') X=${i}.${X:0-9} mv -f "${i}" "${X}" touch "${i}" && chmod 640 "${i}" && chown root:admin "${i}" if [ -x /usr/bin/gzip ]; then gzip -9 "${X}"; fi fi done if [ -f /var/run/syslog.pid ]; then kill -HUP $(cat /var/run/syslog.pid | head -1); fi echo "" -- Since I recently set up a PCBSD 1.4.1 machine to play with, I see that log "rotation" is no longer done with scripts but rather with newsyslog. If I read the man page correctly, newsyslog "rotates" the log files in the good old way though it seems to have a much more comprehensive approach as to when to do it. I've had no difficulties with the change made on my Mac OS X Jaguar system - if it affects something, the something is something I apparently don't do. So, all that preamble brings me to my question. Are there things that modifying the archived log data file names would interfere with? -- Walter M. Pawley Wump Research & Company 676 River Bend Road, Roseburg, OR 97470 541-672-8975