Previous section   Next section

Recipe 18.11 Maintaining Syslog Files on the Server

18.11.1 Problem

You want to automatically rotate and archive router log files on a Unix server.

18.11.2 Solution

The Bourne shell script given in Example 18-1 will automatically rotate router log files to ensure that these files don't become too big and cumbersome to navigate. The script is intended to be invoked via a cron job on a daily basis, but you can also run it manually. By default, the script retains seven days' worth of archived log files and compresses files older than two days. No arguments are required or expected.

Example 18-1. rotatelog.sh
#!/bin/sh
#
#  rotatelog.sh -- a script to rotate log files and
#                  compress archived files 
#
# Set behavior    
SYSLOGPID=/etc/syslog.pid    
LOGDIR=/var/log
LOG=rtrlog
DAYS=7
COMPRESS="/usr/bin/compress -f"
#                         
# Program body
[ -f $SYSLOGPID ] || echo "Syslog PID file doesn't exist"
if [ -d $LOGDIR ]; then
  cd $LOGDIR
  [ -f $LOG.1 ] && `$COMPRESS $LOG.1` && sleep 1
  while [ $DAYS -gt 1 ]
  do
        LOW=`expr $DAYS - 1`
        [ -f $LOG.$LOW.Z ] && mv $LOG.$LOW.Z $LOG.$DAYS.Z
        DAYS=$LOW
  done
[ -f $LOG ] || echo "Log file $LOG doesn't exist"
[ -f $LOG ] && mv $LOG $LOG.1
touch $LOG
chmod 644 $LOG
sleep 10
kill -HUP `cat $SYSLOGPID`
#
else
echo "Log directory $LOGDIR is not valid"
fi

18.11.3 Discussion

If left unchecked, the router log files grow until you run out of disk space. This script is designed to rotate router log files on a daily basis to ensure that they don't grow too large.

This script will rotate logs on a daily basis and retain seven days worth of archived log files, overwriting files that are older than this. To reduce the required disk space of the archived log files, the script will retain the previous day's log in a normal format, and compress the remaining days. The number of archived days stored by the script is completely configurable. For instance, to change the number of archived days to 30, alter the DAYS variable:

DAYS=30

The script is configured to rotate a file called /var/log/rtrlog, but it can easily be modified to rotate any log file by changing the LOGDIR and LOG variables. LOGDIR contains the directory that the log files reside in, while LOG contains the name of the log file itself. For instance, if you want to change the script to rotate a file called /var/adm/nmslog, modify the following lines in the script:

LOGDIR=/var/adm
LOG=nmslog

The final variable that may require modification is the SYSLOGPID variable. This variable contains the location of your system's syslog.pid file. The script assumes that the process ID number (PID), which is carried by the SYSLOGPID variable, can be found in the file /etc/syslog.pid. This is a common location for Solaris-based machines (another common location is /var/run/syslog.pid). Configuring the script with the correct syslog.pid location is vitally important—your log files will not rotate correctly if it is misconfigured. To find the location of your syslog.pid file on your system, use the following command (which can take several minutes to run):

server% find / -name syslog.pid -print
/etc/syslog.pid
server%

As mentioned, the script is intended to be launched from cron on a nightly basis. Since it will likely require root privileges to create the necessary files, launch the script from root's crontab. Below is an example of the crontab entry required to launch the script each day at midnight (assuming it is located in /usr/local/bin):

0 0 * * *               /usr/local/bin/rotatelog.sh

Finally, since archived files older than one day are compressed, we should mention some methods of working with compressed files. To view a compressed file, use the zcat command or uncompress -c command. To permanently uncompress a compressed file, use the uncompress command (without any switches).


  Previous section   Next section
Top