Vsftpd rotate logs with newsyslog...

[David Robillard]

>> Thank u all very much guys....i will see if i do a graceful or simply a
>> restart cause i dont think the apache will be getting too many connections
>> all the time....but that clarifications was quite good David....and thank u
>> for the example....that is always the best way to understand things...much
>> appreciated...
>>
>> Will try both....just a question about compression...What i understood
>> from your mail is that as apache takes some time to let his children close
>> all connections i shouldn zip those logs cause, newsyslog wont wait till
>> apache finishes and probably will xip logs that are still being access by
>> the children? if htat is the case using a HUP will close all and allow me to
>> use compresion?

Yes it would. But if you go this route, you might loose some logs from
the childrens. If you don't run a busy server with lots of hits and
lots of VirtualHosts, then that might not be a problem for you. Like
Ruben said, YMMV.

IMHO, if the Apache Best Practices and documentation say you should
use USR1 and not compress the logs automatically via newsyslog(8) or
logrotate(8), then that's what I do.

Of course, you can compress the logs at a later time once the files
have been rotated of course. But with today's disk sizes and SAN
storage, I'd be surprised that a few Apache log files can pose a disk
space problem.

Think of it another way. If today you run a single very small site,
then you might want be tempted to use HUP and compression simply
because it's easier and, well, it works. Agreed that using USR1 seems
a little more complicated (a little) and might seem like an overkill
setup for a single small site.

But tomorrow you might end up working for a very large site that runs
a huge number of VirtualHosts with thousands of hits per seconds on a
three-tier web platform that has a cluster of web servers, application
servers and backend databases. If you've learned and used the Best
Practices back in the days when you had your single little web site,
then it won't be a secret to you and you'll be ready to tackle the
demands of a bigger site. Besides, it's not like using USR1 is some
form of arcane black sysadmin magic, right? :)

If you need more info on this topic, check out the official
documentation (i.e. RTFM ;-)

Apache 1.3
http://httpd.apache.org/docs/1.3/stopping.html

Apache 2.0
http://httpd.apache.org/docs/2.0/stopping.html

Apache 2.2
http://httpd.apache.org/docs/2.2/stopping.html


> Sorry guys...got one more doubt....Why do u use B (binary) if apache logs
> are simple text? any particular reason?

>From the newsyslog.conf(5) man page:

             B      indicates that the log file is a binary file, or has some
                     special format.  Usually newsyslog(8) inserts an ASCII
                     message into a log file during rotation.  This message is
                     used to indicate when, and sometimes why the log file was
                     rotated.  If B is specified, then that informational mes-
                     sage will not be inserted into the log file.

Indeed, the Apache logs are ASCII files. I use the B flag in
newsyslog.conf(5) simply because I don't want to have newsyslog(8) to
write anything in the Apache logs. Why? Because it confuses our Apache
log file analyzers. That's all. I mean, I know the reasons why the
logs are rotated and I know that it's newsyslog(8) that did it (I
should know, I'm the one who configured it). So I don't need a
reminder inside the logs about it. Once again, YMMV.

HTH,

David
-- 
David Robillard
UNIX systems administrator & Oracle DBA
CISSP, RHCE & Sun Certified Security Administrator
Montreal: +1 514 966 0122