how to understand logrotate.d

[vcpguy]

Hi,

I am trying to understand the logrotate.d /vmkernel file The contents of the file are

/var/log/vmkernel{

create 0600 root root

missingok

nocompress

1. keep a history over 3 years.

monthly

rotate 36

1. max log size of 200k (thus limiting total disk usage to under 8megs)

size 200k

sharedscripts

postrotate

/bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null || true

endscript

}

~

~

If, I check my /var/log there are jus 5 vmkernel log files. I thought it should have 36 as per the file. Unless I am mistaken here.Also, please tell me what does each line does to the vmkernel log file.

Thanks

[COdlk]

How long has you ESX server been up and running?

I think the important configuration items are:

monthly - Log files are rotated the first time logrotate is run in a month (this is normally on the first day of the month).

rotate - Log files are rotated <count> times before being removed or mailed to the address specified in a mail directive. If count is 0, old versions are removed rather then rotated.

size - Log files are rotated when they grow bigger then size bytes. If size is followed by M, the size if assumed to be in megabytes. If the k is used, the size is in kilobytes. So size 100, size 100k, and size 100M are all valid.

david

[vcpguy]

Are you trying to say, we have to run this script and it wont run on its own ? I thought it was a configuration file and it should run.

Thanks

[vcpguy]

Ok, I got some more configuration details about the logrotate from the man logrotate cmd

CONFIGURATION FILE

logrotate reads everything about the log files it should be handling

from the series of configuration files specified on the command line.

Each configuration file can set global options (local definitions over-

ride global ones, and later definitions override earlier ones) and

specify a logfile to rotate. A simple configuration file looks like

this:

1. sample logrotate configuration file

compress

/var/log/messages {

rotate 5

weekly

postrotate

/sbin/killall -HUP syslogd

endscript

}

"/var/log/httpd/access.log" /var/log/httpd/error.log {

rotate 5

mail www@my.org

size=100k

sharedscripts

postrotate

/sbin/killall -HUP httpd

endscript

}

/var/log/news/news.crit {

monthly

rotate 2

olddir /var/log/news/old

missingok

postrotate

kill -HUP `cat /var/run/inn.pid`

endscript

nocompress

}

I wonder, how have people configured their logs? Any more information about this will be highly appreciated. I am preparing for the Enterprise exam and logging is their as 1 of the section. So, please share all the information you have.

Thanks

[COdlk]

By default it is run by cron. If you look in /etc/cron.hourly you should see a file named logrotate. Cron calls this on an hourly basis. there are alot of configuration files involved with both logrotate and cron.

david

[vcpguy]

OK, so what is the difference between logrotate.conf and logrotate.d/vmkernel file ?

[COdlk]

/etc/logrotate.conf has a line that says

include /etc/logrotate.d

So, basically logroate looks at all the configuration files in /etc/logrotate.d. Makes it a little cleaner. If you wanted you could have one huge logrotate config file.

david

[vcpguy]

OK, did some more research and got information about logrotate.

It is a old linux cmd used to manage the logs, it is not new in ESX. Infact if you do some research on linux with logrotate you will get lots of information as to how to configure this.

Thanks