[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: Solaris log files
On Feb 20, 12:03, Mark R. Lindsey wrote:
>
> This raises an interesting philosophical issue related to the organization
> of the filesystem tree; in this case,
> * Does it make more sense to keep all of the log files together?
/var/adm, /var/log, .../httpd/logs/access.log, etc., etc. - I vote yes.
> For active systems, you have to decide whether it's better to have
> /var/log/1999/02/20/cron
> /var/log/1999/02/20/ftp
> &c., or to have
> /var/log/cron/1999/02/20
> /var/log/ftp/1999/02/20
I vote for /var/log/cron.19990220, /var/log/ftp.19990220,
/var/log/authlog.199902, etc. Do you have so many logs online that they
need more than one flat directory? Then go one more level down, but not 4.
Also, putting the timestamp in the filename makes restores and greps of
the files less confusing.
But I think the problem is even bigger than that.
Some log files grow VERY RAPIDLY -- many megabytes per day.
Some grow very slowly. authlog comes to mind.
It's best to keep individual log files under some certain size.
1MB is great. 10MB is OK. 50MB is getting kinda big.
But with these different growth rates, the tendency is to age some of
them daily, others weekly, others yearly(!).
Then there's the annoying ones like wtmp that are binary.
And let's not forget that some processes need to be restarted after a
logfile move, while others don't.
And some programs follow the paradigm "my logfile must exist and be
writable by me or else I will silently log nothing".
I've always considered writing some tool that would allow you to manage
and age all your log files from one config file. Maybe the config file
would be a table that lists the base logfile name, the interval at which
it gets aged, the number of logs or amount of space to keep online before
deleting them, etc.
Anybody know of any such program? It might be too much work for
too little gain.
The ultimate would be an ADAPTIVE process that keeps fewer old logs online
if space is getting tight, etc. Personally I think an adaptive news
expire program would be nice, too.
I'll get right on these, as soon as I get this other stuff done for
my boss... :-)
Todd Williams Manager, Computer and Communication Systems
MacNeal-Schwendler Corp. ("MSC"), 815 Colorado Blvd., Los Angeles, CA 90041
todd.williams@macsch.com (323)259-4973 http://www.macsch.com/
geek n. : a carnival performer often billed as a wild man whose act usu.
includes biting the head off a live chicken or snake -Webster's New Collegiate