Embed Notice

Some computer problems really amaze me. They are truly self inflicted pains in the ass.

For example, log rotation.

We have:

foo
foo.0.gz
foo.1.gz
foo.2.gz
...
foo.N.gz

So, for every log rotation cycle, you:
delete foo.N.gz
rename foo.N-1.gz foo.N.gz
all the way to:
rename foo to foo.0 and compress

This is not even remotely simple.

The way I do it?

foo-<datestamp>

I run two cronjobs to deal with this.

One, adjusts the symlink of foo to foo-<datestamp> to the most current file. A very basic shell script.
The other, deletes logfiles older than <retention period>. A find command, nothing more.

Optional third cronjob compresses logfiles older than, "I hope I don't need these" period.

So, for "now" logs, I just check "foo".
I usually default to daily rotations, so I have a lot of symlinks that look like this:

/var/log/auth -> /var/log/secure/auth-<YYYYMMDD>
/var/log/sudo -> /var/log/secure/sudo-<YYYYMMDD>
/var/log/daemon -> /var/log/system/daemon-<YYYYMMDD>

For some bigger installations, I have broken it up more, but daily usually works for me. I have also resorted to directory hashing like YYYY/MM/DD.HH, for entities that generate shitloads of logs. Instead of running a rotation script that touches every single logfile, I only care about the current one. Once logfiles are closed, they are closed forever, never renamed, unless I wanted to compress them.

But my point? The default behavior is, honestly kind of stupid. The defaults for so much software are so terribly stupid.