After installing Leopard Server and ISC DHCPD, I had an itch- my logfile that I created (/var/log/dhcpd.log) was not getting rolled like the other logs. I started looking into how Apple does this, and found a nice utility that is new in Leopard, although not new to the UNIX world… newsyslog.
Read on for more…
Newsyslog is configured in /etc/newsyslog.conf, has a nice set of manpages, and is easily modifiable to add your own logs into the mix, allowing it to automatically compress and roll them.Taking a look at a single line in newsyslog.conf, we can pick it apart…
/var/log/system.log 640 7 * @T00 J
/var/log/system.log - The log file in question.
640 - The permissions for the log file and its archives.
7 - maximum number of archives to keep.
* - maximum size of archive, in kilobytes.
@T00 - Time to roll logs, in ISO 8601 format. This is midnight.
J - compress archive using bz2
Now, when I created my line in the configuration file, I started with the system.log line, but then added a maximum filesize of 100k.
Looking at the other lines in newsyslog.conf, we see that Apple has placed a 100K limit on every log except wtmp and system.log. Essentially, this means that the logs can be rolled at any time, given that they don't have a time-based element. You may want to reconfigure that, or at minimum bump each one up by a couple hundred K if your server has a great amount of activity.
by 
Recent Comments