Apache access log rotation

Question

I think my system is using logrotate for rotating logs including httpd logs

The "current" files is logged here /var/log/httpd/ but I only see the last 5 days(I think)

But how can I find where previous log file exists. I thought they was created at the same place as the current.

I have been looking around in logrotate but is not getting any wiser, anyone here who could help me?

Thanks in advance,

bob

Solution 1

You probably have something looking like this in your logrotate configuration file

"/var/log/httpd/access.log" /var/log/httpd/error.log {
           rotate 5
           size=100k
           sharedscripts
           postrotate
                                     /sbin/killall -HUP httpd
           endscript
       }

rotate 5 means that only last 5 files will be keept. Here file are turned every 100k.
if you have the daily keyword it means that each archived file is 1 day of log. If you want to keep file longer on the server you have to increase the rotate value

Solution 2

Logrotate will usually use the same filename with a number appended, such as access.log.1. The compressed logs will then have a .gz after that, so an older access log will be access.log.3.gz (for example).

There are other ways to rename old log files (such as by date), but they're relatively uncommon, and it's unlikely that they'll be configured without you explicitly doing it.

Solution 3

As others have indicated here, looks like older ones are gone. I ended up writing custom rotation scripts that ran daily so that we could keep apache logs for longer periods for analysis. The only trick was you have to restart apache right after you rename the files.

Also of course, if you are doing what we did and naming files with a date pattern like YYYYMMDD, I reccommend you start the rename script slightly after midnight, not before. This is counter intuitive as then files are named "wrong", but if your script is like mine was and has to get many huge logs rotated and gzipped from lots of websites, it can take some time. You just don't want any ambiguity in what day exactly your script will be getting it's datestamp- if on Monday it runs and load is low and it gets a datestamp at 23:59, but Tuesday load is really high and it gets its datestamp at 00:01 - well, the problem is that Wednesday's logs are going to overwrite Tuesday's logs in the worst case, or just fail to rotate. So just plan to always run the thing just after midnight so you know you aren't going to have this problem.

Comments

[radius]

I think is he's seeing file as he told 'but I only see the last 5 days' but wondering where are olders one.

[womble]

@radius: Huh? I don't understand your comment.

[radius]

I was meaning that I guess he is seeing access.log.X.gz files but wonder where are files with X > 5 (assuming he has a 1 day rotation configured)