Hi there

I need to set our log files to rotate daily. I only need the raw log files from the server, not Webalizer or AWstats, and this is something I've done before on an old server - but it took 3 days of three people looking at it before we finally happened across the right method. (Of course, we had to wait until 4am every morning to see if the processes were working!)

In cPanel, there is simply an option to rotate logs files monthly, and to delete old log files (or not). So I assume I have to tinker with /etc/cron.d and associated files, and go it alone. but...

Are the log files for each account on the server created individually, and left in /var/log/ ?

I forced a logrotate of logrotate.conf with -dfv and it seems to rotate all log files except anything to do with individual accounts or domains.

Could anyone explain exactly what file I have to place what piece of script in to get daily log files generated?

Thank you

You can add the following to a new file in /etc/logrotate.d:


You can change the rotate to to 1 or 10 or however many old logs you want to keep. This will also compress the logs in gzip format to conserve space.

Hi

I tried your script. Had to change the top line to 'access_log' before it would work though:



...but the access logs aren't recording the server traffic - maybe just the access to the web host manager? Here's a smaple of the output:



Presumably I've got the right core but in the wrong place. Any ideas what I need to do to see the access_log files? Do I need to check vertain boxed in the WHM to generate log files, or is that automatic?

Just an update...

cPanel says I've got Webalizer, Urchin and Analog stats running. However, Urchin returns no data while the other two do.

I can log into cPanel and see the results, and one page even lets me download today's single gz file of stats. However, it says it's at :2083/getaccesslogs/ ... which I can't find via the terminal or FTP, and it has no archive (no list of files) so it's useless for my needs unless I want to log on every single day for the rest of my life....

If all those apps are generating stats, there must be access_log files somewhere...?

cPanel stores the access_log data in /usr/local/apache/logs/domainname.com-access_log. That is why I used the wildcard "*-access_log." The access_log file itself stores the access data for any requests that are not defined in a virtualhost (that is, a virtualhost with a specified customlog).

EDIT:
Sorry, I was mistaken...I've gotten to used to working with vanilla Red Hat installs...

cPanel stores the access logs as /usr/apache/domlogs/domainname.tld.

aha!

I found what might be those files in /usr/local/apache/domlogs using domain.tld as you said.

So I amended my script to this:



Which took a while, but appeared to work. I'm not sure about the use of '*' but not sure how else to grab the specific files I'm after without naming them all by hand. Next up, I need to date them so they don't get deleted.

My guess is:



...but again, I'll have to name domains specifically for the files I want to archive.

Do you think this will work OK, or am I about to bring my new server to its knees?

I would suggest you do not use just a wildcard in domlogs. There is more information in there, too, such as the bandwidth offsets for the websites, which may bring on incorrect bandwidth reports in WHM.

I would put the exact files you want to rotate. And if you want them dated, I don't think logrotate will do that - you'll need to make a script for that one. Pretty simple, however. But don't use the mv command with the active logs. Instead, do it this way so Apache doesn't need to be restarted:


That will do as logrotate does with "copytruncate" - copy the logfile contents and then truncate the original logfile without deleted it.

I named the specific domains that I need rotating and that's cleaned everything up - thanks.

However, I figure that if I simply copy and rename the most recent zipped up file, dating it in the process, then that would have the same effect. I didn't want to upse the logrotation process, and this seemed to be the most logical way around:



Unfortunately, however, although the last line works at command line level if i simply type it in, it doesn't seem to work within the file in the logrotate.d folder. Do I need to restart apache to make this work? Or am I doing something stupid?

That last line is simply just not an action that logrotate does...or parses in the config file.

You can setup a cron to call the specific logrotate file and the cp command immediately after, or just do it as I said above.

Ok, so I was doing something stupid.

Thanks for your help - think I've got it nailed now.

If you are going to use wildcards I would suggest using the oldlogs directive or you will rotate rotated logs.

Hi, I'm lost with logrotate... I need your help.

I'm running rhe3 / cpanle / whm

My apache stats stay to zero since /usr/local/apache/domlogs/mydomain.com is 2GB

So I did this : (mydomain.com is just to understand)

in /etc/logrotate.d
I created the script file apache :
/usr/local/apache/domlogs/mydomain.com {
monthly
rotate 36
compress
missingok
notifempty
sharedscripts
postrotate
/sbin/killall -HUP httpd
endscript
}

in cron I created the entry :

0 4 * * * /usr/local/sbin/logrotate /etc/logrotate.conf

first thing : is what I did ok ?
and how could I do to force a rotation right now, because of my 2GB log file ?

Thank you for your help

You shouldn't need to add a cron entry for logrotate. It should already process daily because there is a script for it in the /etc/cron.daily directory. You can run it now by using the logrotate command.

logrotate /etc/logrotate.d/apache

Thank you very much.

I deleted the cron job, then launched manually logrotate /etc/logrotate.d/apache

But my log file is still 2GB

I cannot see any logrotate daemon with ps, does it mean my problem is here ?

I searched further.

The logrotate is ok in the /etc/cron.daily
(no more in the crontab)

when running manually : logrotate -dv /etc/logrotate.d/apache

I get :

reading config file /etc/logrotate.d/apache
reading config info for /usr/local/apache/domlogs/mydomain.com

Handling 1 logs

rotating pattern: /usr/local/apache/domlogs/mydomain.com monthly (36 rotations)
empty log files are not rotated, old logs are removed
considering log /usr/local/apache/domlogs/mydomain.com
log does not need rotating
not running shared postrotate script, since no logs were rotated

How could I force rotation and get my 2GB file compressed ?

My server seems to be ok now

It was urgent for me, so I stopped httpd, then compressed de log file, removed the big 2GB one, and restarted httpd, to create the log file from scratch.

Thank you for your help on this forum, it helped me understanding things that you don't consider, because of lack of time.

thx