Articles March 3, 2008 at 3:04 pm

newsyslog – Automatic rolling of logfiles

After installing Leopard Server and ISC DHCPD, I had an itch- my logfile that I created (/var/log/dhcpd.log) was not getting rolled like the other logs.  I started looking into how Apple does this, and found a nice utility that is new in Leopard, although not new to the UNIX world… newsyslog.

Read on for more…

Newsyslog is configured in /etc/newsyslog.conf, has a nice set of manpages, and is easily modifiable to add your own logs into the mix, allowing it to automatically compress and roll them.Taking a look at a single line in newsyslog.conf, we can pick it apart…

/var/log/system.log                     640  7     *    @T00  J 
    /var/log/system.log - The log file in question.
    640 - The permissions for the log file and its archives.
    7 - maximum number of archives to keep.
    * - maximum size of archive, in kilobytes.
    @T00 - Time to roll logs, in ISO 8601 format.  This is midnight.
    J - compress archive using bz2

Now, when I created my line in the configuration file, I started with the system.log line, but then added a maximum filesize of 100k.

Looking at the other lines in newsyslog.conf, we see that Apple has placed a 100K limit on every log except wtmp and system.log.  Essentially, this means that the logs can be rolled at any time, given that they don't have a time-based element. You may want to reconfigure that, or at minimum bump each one up by a couple hundred K if your server has a great amount of activity.

Leave a reply

You must be logged in to post a comment.