the corner office

The logrotate application 'rotates' log files at specified time intervals. Log files are backed up and renumbered, and older logs are gzipped to save space.

This is great for most cases, but is a problem if you want to keep logs permanently, like I do with my website. The renumbering isn't ideal: every time the logs are rotated, each and every file has its number incremented by 1. This isn't rsync-friendly and complicates backups. Also, after a specified number of rotations, old files are dropped. Setting ridiculously high rotation counts is a kludge: I don't want my logs to be deleted by anyone but me.

Cronolog is a utility which can be set up to write log files using timestamps, so it's possible to have a 2007-03-07_access.log, say. The naming formats are highly configurable and can dynamically create subdirectories. I came across it a year ago, made a mental note to revisit it, and never did. The application itself went unmaintained for a number of years, but I'm glad to see that as of early 2007 there's some activity again. That's good news because a cursory search around the web finds lots of good things said about cronolog, and very few bad.

Disabling logrotate

I fiddle with these things so rarely that I can never remember how they fit together. Cheat notes for my Debian server follow:

• logrotate is run as a cron job, cron entry is /etc/cron.daily/logrotate.
• the cron job simply executes /usr/sbin/logrotate.
• Configuration for the file is in /etc/logrotate.d/apache2
• The config file is set to run on all files matching pattern /var/log/apache2/*.log.

All that's needed to disable logrotate for apache2 is to move the file out of the /etc/logrotate.d directory.

Enabling cronolog

Installing on Debian:

apt-get install cronolog

(Note: I think there's a newer version, but I played it safe and used the packaged version.)

Update server config files (eg. /etc/apache2/sites-available/colinpretorius.org), modifying the CustomLog and ErrorLog lines:

#   ErrorLog /var/log/apache2/error.log
    ErrorLog "|/usr/bin/cronolog /var/log/apache2/%Y%m%d_cp_error.log"
#   CustomLog /var/log/apache2/access.log combined
    CustomLog "|/usr/bin/cronolog /var/log/apache2/%Y%m%d_cp_access.log" combined

I've kept the old lines commented out, in case I want to switch back quickly. The | in the argument tells Apache to pipe log output to cronolog.

All that's needed is a restart of the server, and Bob's your aunty.

References

http://www.cronolog.org. The features and FAQ pages pretty much explain it all, with a number of examples.