Logadm

logadm uses a configuration file



logadm.conf

. The latter specifies the schedule for log rotation and
options with which rotation will be performed. In the default configuration of



logadm.conf

the
/var/adm/messages file is already configured to be
rotated:

As you can see from the line above, we specified /var/adm/sshdlog

as our log to rotate.

Like with cron, the -w option to logadm(1M) is the preferred way to modify
the configuration file, but if you do edit it by hand. In this case use "logadm -V" to
check it for errors and to activate changes.

For example, one entry in the /etc/logadm.conf file
specifies that the /var/log/syslog file is rotated weekly unless the
file is empty. The most recent syslog file becomes syslog.0,
the next most recent becomes syslog.1, and so on. Eight previous syslog log files are kept. The /etc/logadm.conf file also contains time stamps of when the last
log rotation occurred. It is written in the field defined by -P flag.

You can use the logadm command to customize system logging and to
add additional logging in the /etc/logadm.conf file as needed.

For example, to rotate the Apache access and error logs, use the following
commands:

In this example, the Apache access_log file is rotated when it
reaches 100 Mbytes in size, with a .0, .1, (and so on) suffix,
keeping 10 copies of the old access_log file. The error_log is rotated
when it reaches 10 Mbytes in size with the same suffixes and number of copies as
the access_log file.

The /etc/logadm.conf entries for the preceding Apache log rotation
examples look similar to the following:

You can use the logadm command as superuser or by assuming an
equivalent role (with Log Management rights). With role-based access control (RBAC),
you can grant non-root users the privilege of maintaining log files by providing
access to the logadm command. For example, add the following entry to the /etc/user_attr file to
grant user andy the ability to use the logadm command:

Or, you can set up a role for log management by using the Solaris Management
Console. For more information about setting up a role, see "Role-Based Access
Control (Overview)" in System Administration Guide: Security Services.

The log rotation problem exists on any server but it is the most acute on log
consolidation servers (LOGHOST servers) that collect logs from other servers.
The volume of logs on a busy Solaris loghost system grow over 50G in a week. On
a typical loghost just log for /var/adm/messages
can easily be large then 1G in one day.

Old News ;-)

If you run busy Solaris servers, you may have
realized that the logfiles in /var/log and /var/adm can grow pretty large.
These files are periodically rotated with the Solaris logadm utility, but
they are not compress with the default logadm configuration.

To change this behavior, you can add use the
“-z 0″ option to compress logfiles after they are rotated:

$ logadm
-w /var/log/maillog -C 8 -P ‘Wed Dec 21 19:56:59 2005′ -a ‘kill -HUP `cat /var/run/syslog.pid`’
-s 1m -z 0

Once the “-z” option is added, you can check
the configuration by running logadm with the “-V” option:

$ logadm -V | grep maillog

/var/log/maillog -C 8 -P ‘Wed Dec 21 19:56:59 2005′ -a ‘kill -HUP `cat /var/run/syslog.pid`’
-s 1m -z 0

If you would like to compress existing files
and force a rotation, you can invoke logadm with the “-p now” option:

$ logadm
-p now /var/log/maillog

Hopefully this will save folks some disk
space (not that it’s really required with the size of today’s disks).

mail-archives.apache.org/mod_mbox/httpd-users/200305.mbox/%3COFCE658C9F.94C103D4-ON85256D2B.006D9A13-85256D2B.006F3113@wkamerica.notes.chrysler.com%3E">
[users@httpd] Piped Log Rotation

I've written a simple PERL program that I'm using to pipe the CustomLog=
s
that will split our logs into 24hour chunks:

CustomLog "| /usr/local/apache/bin/siphon.pl --file /tmp/access --time
12:00AM" common

=A0It functions very similar to the rotatelogs program that comes with =
Apache
but writes to our standard files names that we use for logs here
(access.15May-12AM). Couple of questions about the piped CustomLog. One=
, is
there anyway to have it pipe to my PERL script without spawning and
intermediate shell? Here's what the process table looks like right now,=
it
spawns an sh process to run the perl process:

# ps -fj -g 25982
=A0 =A0 =A0UID =A0 PID =A0PPID =A0PGID =A0 SID =A0C =A0 =A0STIME TTY =A0=
=A0 =A0TIME CMD
=A0 nobody 25985 25982 25982 25982 =A00 16:02:10 ? =A0 =A0 =A0 =A00:00
/usr/local/apache/bin/httpd
=A0 =A0 root 25983 25982 25982 25982 =A00 16:02:10 ? =A0 =A0 =A0 =A00:0=
0 /bin/sh
-c =A0/usr/local/apache/bin/siphon.pl --file /tmp/norm --time 11:41
=A0 nobody 25988 25982 25982 25982 =A00 16:02:10 ? =A0 =A0 =A0 =A00:00
/usr/local/apache/bin/httpd
=A0 =A0 root 25984 25983 25982 25982 =A01 16:02:10 ? =A0 =A0 =A0 =A00:0=
0 /usr/bin/perl
/usr/local/apache/bin/siphon.pl --file /tmp/norm --time 11:41
=A0 nobody 25987 25982 25982 25982 =A00 16:02:10 ? =A0 =A0 =A0 =A00:00
/usr/local/apache/bin/httpd
=A0 nobody 25989 25982 25982 25982 =A00 16:02:11 ? =A0 =A0 =A0 =A00:00
/usr/local/apache/bin/httpd
=A0 nobody 25986 25982 25982 25982 =A00 16:02:10 ? =A0 =A0 =A0 =A00:00
/usr/local/apache/bin/httpd
=A0 =A0 root 25982 =A0 =A0 1 25982 25982 =A00 16:02:10 ? =A0 =A0 =A0 =A0=
0:00
/usr/local/apache/bin/httpd

Second question is this. If the web admin botches the args for this PER=
L
program, I'd like to kill the HTTPD process so that they know right awa=
y
that there's a problem (rather then just sending a message to STDERR wh=
ich
is going to go unnoticed into the error log unless they check right awa=
y).
Since there is an intermediate shell process in between my program and =
the
parent httpd process, I can't simply kill my parent to kill the web ser=
ver.
Is it safe instead to get the Process Group ID and send a kill to it?
(getpgrp()) This is written specifically for UNIX environments (solaris=
and
aix), not Wintel.

Thanks for the help.

-Norm Ackroyd=

Old News ;-)

Configuration

Setting Up logadm to Run from cron