rotatelogs is rotating too quickly...

[Bill Moran]

In response to John Almberg <jalmberg at identry.com>:

> I'm a newbie admin and I've just figure out something that will be  
> obvious to most on this list... that apache log files can get big, fast.
> 
> I did a df for another reason the other day and was surprised to see  
> my /var partition at 85% full.
> 
> Anyway, I did some googling and decided to use rotatelogs to do just  
> that.
> 
> Now... I've updated all my apache config files to use rotate logs,  
> like this:
> 
> ErrorLog  "|/usr/local/sbin/rotatelogs /var/log/www/nes.com-error.log. 
> %Y-%m-%d-%H_%M_%S 86400"
> CustomLog "|/usr/local/sbin/rotatelogs /var/log/www/nes.com- 
> access.log.%Y-%m-%d-%H_%M_%S 5M" combined
> 
> Unless I am blind and not seeing something, this is right out of the  
> man page.
> 
> The problem is that the access logs are rolling over very quickly...  
> no where near the 5 Meg I expected. It's not quite every access, but  
> almost.
> 
> -rw-r--r--  1 root  wheel       5147 Aug 20 08:19 nes.com-access.log. 
> 2008-08-20-12_19_25
> -rw-r--r--  1 root  wheel        204 Aug 20 08:21 nes.com-access.log. 
> 2008-08-20-12_20_58
> -rw-r--r--  1 root  wheel        195 Aug 20 08:24 nes.com-access.log. 
> 2008-08-20-12_24_24
> -rw-r--r--  1 root  wheel        204 Aug 20 08:26 nes.com-access.log. 
> 2008-08-20-12_26_15
> -rw-r--r--  1 root  wheel        181 Aug 20 08:29 nes.com-access.log. 
> 2008-08-20-12_28_44
> -rw-r--r--  1 root  wheel        181 Aug 20 08:31 nes.com-access.log. 
> 2008-08-20-12_31_35
> -rw-r--r--  1 root  wheel        204 Aug 20 08:34 nes.com-access.log. 
> 2008-08-20-12_34_25
> -rw-r--r--  1 root  wheel        284 Aug 20 08:37 nes.com-access.log. 
> 2008-08-20-12_36_56
> -rw-r--r--  1 root  wheel        710 Aug 20 08:45 nes.com-access.log. 
> 2008-08-20-12_40_09
> -rw-r--r--  1 root  wheel       3364 Aug 20 08:38 nes.com-error.log. 
> 2008-08-20-00_00_00
> 
> I've been scratching my head over this for an hour, but can't see  
> anything wrong. Any hints much appreciated.

While your configuration certainly matches the examples in the docs, I
can't imagine (for the life of me) how that would work.  How would each
httpd process know not to step on the toes of another when rotation time
occurred?  And what timestamp should it use when writing to the file --
the current one or the one when the process was started?

Despite the fact that the docs say otherwise, the behaviour you're seeing
is what I would _expect_.

I hate to bring up this possibility, but perhaps the docs are _incorrect_!

*blasphemy*!!

Anyway, all ridiculous melodrama aside, I suspect that rotatelogs does
perform as advertised, or (possibly) that the version of docs that you're
reading does not match the version of rotatelogs that you're using.

I know it's not a great answer, but it's the best I've got.  Why not use
the first example in the man page, as it seems much more likely to
actually work in my opinion.

-- 
Bill Moran
http://www.potentialtech.com