Topic: Log File Management

[Erik Tank]

Hello everyone, this might sound odd, but I would like to know how everyone manages their log files.  

Could someone possibly explain when the SME server splits the log file and archives it?  

I am using SME version 5.1.2 and would like to split the log file for the squidguard access.log by individual days.  Forexample, have access1.log be monday, access2.log be tuesday or something similar to this.  Does anyone have any comments to share, perferably the positive comments please?

Thanks for any info.

Erik Tank

[Erik Tank]

Wow a whole day went by and no one posted any info... this doesn't feel good!

I am somewhat weary about copying or moving the /var/log/squid/access.log because the last time I did, SQUID (the service) would start, but fail to stop, and hence it would not work anymore for some reason... I am reluctant to play with the log files if I can avoid it.  Can anyone help me out here?

Thanks,

Erik

[Ad]

Curious as how it worked, I snooped around. I've found that the program logrotate (/usr/bin/logrotate) does most of this, in the configuration file (/etc/logrotate.conf) you can specify what to do, at what interval.

/etc/logrotate.conf points to the directory /etc/logrotate.d. In that directory, there's a file per service that needs it's log rotated. The file for squid looks like (SME 5.1.2):

/var/log/squid/access.log {
    weekly
    rotate 5
    copytruncate
    compress
    notifempty
    missingok
}
/var/log/squid/cache.log {
    weekly
    rotate 5
    copytruncate
    compress
    notifempty
    missingok
}

/var/log/squid/store.log {
    weekly
    rotate 5
    copytruncate
    compress
    notifempty
    missingok
# This script asks squid to rotate its logs on its own.
# Restarting squid is a long process and it is not worth
# doing it just to rotate logs
    postrotate
      /usr/sbin/squid -k rotate
    endscript

See also the manual page for logrotate.