[svlug] Complicated logs rotation under cron and date format in Linux/Unix

[Will Lowe]

> > working Samba connections. New smb daemon fails to authenticate the
> > connection to PDC for whatever reason. All hell breaks loose when people
> > start complaining about problems with Samba and Unix to managers. It took
> > me some time to figure out that the problem was in Samba log rotation.

Sounds like you shoulda tested it before deploying it in a production
environment.

> > Apache log is also crappy to deal with
> > 192.168.10.67 - - [21/Jun/2001:17:08:15 -0700] "GET /www HTTP/1.0" 301 318

You can change that by fiddling with your apache configs.  From
http://httpd.apache.org/docs/mod/mod_log_config.html:


%...{format}t:  The time, in the form given by format, which should
                be in strftime(3) format. (potentially localized)

FWIW, I agree that the default format is silly, but it's done for
historical compatibility, I think -- Common Logfile Format has been
around longer than Apache, and nearly all log-processing utilities can
handle it by default.

> Debian is actually a bit worse because it's inconsistent, many
> packages have their own cron job that uses savelog, and a few use
> logrotate.

FWIW, I despise logrotate.  It doesn't make sense to me to have a
whole seperate logfile for each logfile used to remember when it was
last rotated!  savelog is simple, and deciding how often to rotate
logs with it is equally simple -- just make appropriate cron jobs.  As
far as I can see, the only advantage with logrotate is that it lets me
have a less-well-thought-out crontab.

NEITHER of those alone is really adequate for production log rolling
anyway -- when you have 20+ web servers you need them named by
hostname, probably with the date rolled as part of the filename
... but I think that's something best left to the local admin to
figure out.  I don't want somebody else deciding how I have to handle
my data.

--
					thanks,
		
					Will