From owner-freebsd-questions@FreeBSD.ORG Wed Aug 20 14:18:01 2008 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id EBCF9106567A for ; Wed, 20 Aug 2008 14:18:01 +0000 (UTC) (envelope-from wmoran@potentialtech.com) Received: from mail.potentialtech.com (internet.potentialtech.com [66.167.251.6]) by mx1.freebsd.org (Postfix) with ESMTP id B6C2E8FC24 for ; Wed, 20 Aug 2008 14:18:01 +0000 (UTC) (envelope-from wmoran@potentialtech.com) Received: from vanquish.ws.pitbpa0.priv.collaborativefusion.com (pr40.pitbpa0.pub.collaborativefusion.com [206.210.89.202]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mail.potentialtech.com (Postfix) with ESMTPSA id B89BAEBC11; Wed, 20 Aug 2008 10:18:00 -0400 (EDT) Date: Wed, 20 Aug 2008 10:18:16 -0400 From: Bill Moran To: John Almberg Message-Id: <20080820101816.11fbc23a.wmoran@potentialtech.com> In-Reply-To: <482E252F-3819-46DD-A272-A174C1B41333@identry.com> References: <482E252F-3819-46DD-A272-A174C1B41333@identry.com> X-Mailer: Sylpheed 2.5.0 (GTK+ 2.12.11; i386-portbld-freebsd7.0) Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Cc: freebsd-questions@freebsd.org Subject: Re: rotatelogs is rotating too quickly... X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 20 Aug 2008 14:18:02 -0000 In response to John Almberg : > I'm a newbie admin and I've just figure out something that will be > obvious to most on this list... that apache log files can get big, fast. > > I did a df for another reason the other day and was surprised to see > my /var partition at 85% full. > > Anyway, I did some googling and decided to use rotatelogs to do just > that. > > Now... I've updated all my apache config files to use rotate logs, > like this: > > ErrorLog "|/usr/local/sbin/rotatelogs /var/log/www/nes.com-error.log. > %Y-%m-%d-%H_%M_%S 86400" > CustomLog "|/usr/local/sbin/rotatelogs /var/log/www/nes.com- > access.log.%Y-%m-%d-%H_%M_%S 5M" combined > > Unless I am blind and not seeing something, this is right out of the > man page. > > The problem is that the access logs are rolling over very quickly... > no where near the 5 Meg I expected. It's not quite every access, but > almost. > > -rw-r--r-- 1 root wheel 5147 Aug 20 08:19 nes.com-access.log. > 2008-08-20-12_19_25 > -rw-r--r-- 1 root wheel 204 Aug 20 08:21 nes.com-access.log. > 2008-08-20-12_20_58 > -rw-r--r-- 1 root wheel 195 Aug 20 08:24 nes.com-access.log. > 2008-08-20-12_24_24 > -rw-r--r-- 1 root wheel 204 Aug 20 08:26 nes.com-access.log. > 2008-08-20-12_26_15 > -rw-r--r-- 1 root wheel 181 Aug 20 08:29 nes.com-access.log. > 2008-08-20-12_28_44 > -rw-r--r-- 1 root wheel 181 Aug 20 08:31 nes.com-access.log. > 2008-08-20-12_31_35 > -rw-r--r-- 1 root wheel 204 Aug 20 08:34 nes.com-access.log. > 2008-08-20-12_34_25 > -rw-r--r-- 1 root wheel 284 Aug 20 08:37 nes.com-access.log. > 2008-08-20-12_36_56 > -rw-r--r-- 1 root wheel 710 Aug 20 08:45 nes.com-access.log. > 2008-08-20-12_40_09 > -rw-r--r-- 1 root wheel 3364 Aug 20 08:38 nes.com-error.log. > 2008-08-20-00_00_00 > > I've been scratching my head over this for an hour, but can't see > anything wrong. Any hints much appreciated. While your configuration certainly matches the examples in the docs, I can't imagine (for the life of me) how that would work. How would each httpd process know not to step on the toes of another when rotation time occurred? And what timestamp should it use when writing to the file -- the current one or the one when the process was started? Despite the fact that the docs say otherwise, the behaviour you're seeing is what I would _expect_. I hate to bring up this possibility, but perhaps the docs are _incorrect_! *blasphemy*!! Anyway, all ridiculous melodrama aside, I suspect that rotatelogs does perform as advertised, or (possibly) that the version of docs that you're reading does not match the version of rotatelogs that you're using. I know it's not a great answer, but it's the best I've got. Why not use the first example in the man page, as it seems much more likely to actually work in my opinion. -- Bill Moran http://www.potentialtech.com