newsyslog.conf and Apache log files

[Paul Schmehl]

--On Thursday, October 07, 2010 16:08:23 -0400 Robert Huff <roberthuff at rcn.com> 
wrote:

>
> Joe Auty writes:
>
>>  I have the following entry for dealing with my Apache log files:
>>
>>  /var/log/httpd/*             644  2     *  $M1D0 GBJ
>>  /var/run/httpd.pid 30
>>
>>  Unfortunately, this has created these big long log files such as the
>>  following:
>>
>>  httpderror_log.2.bz2.2.bz2.2.bz2.1.bz2.1.bz2.1.bz2.0.bz2
>>
>>  How can I prevent these dumb log file names from being created?

This is what I use:

/var/log/httpd-access.log               640  5     *    $W0D04 Z 
/var/run/httpd.pid
/var/log/httpd-error.log                640  5     *    $W0D00 Z 
/var/run/httpd.pid
/var/log/rewrite_log                    640  5     *    $W0D00 Z 
/var/run/httpd.pid

And this is the results:
# ls -lsa /var/log/httpd-*
279520 -rw-r-----  1 root  wheel  286062450 Oct  7 16:09 
/var/log/httpd-access.log
 26352 -rw-r-----  1 root  wheel   26960261 Oct  3 04:00 
/var/log/httpd-access.log.0.gz
 26720 -rw-r-----  1 root  wheel   27332026 Sep 26 04:00 
/var/log/httpd-access.log.1.gz
 37984 -rw-r-----  1 root  wheel   38845050 Sep 19 04:00 
/var/log/httpd-access.log.2.gz
 25632 -rw-r-----  1 root  wheel   26214452 Sep  5 04:00 
/var/log/httpd-access.log.3.gz
 24800 -rw-r-----  1 root  wheel   25364090 Aug 29 04:00 
/var/log/httpd-access.log.4.gz
 23568 -rw-r-----  1 root  wheel   24116870 Aug 22 04:00 
/var/log/httpd-access.log.5.gz
  1472 -rw-r-----  1 root  wheel    1477939 Oct  7 16:07 
/var/log/httpd-error.log
   122 -rw-r-----  1 root  wheel     124058 Oct  3 00:00 
/var/log/httpd-error.log.0.gz
   140 -rw-r-----  1 root  wheel     141619 Sep 26 00:00 
/var/log/httpd-error.log.1.gz
   224 -rw-r-----  1 root  wheel     198696 Sep 19 00:00 
/var/log/httpd-error.log.2.gz
   150 -rw-r-----  1 root  wheel     153353 Sep  5 00:00 
/var/log/httpd-error.log.3.gz
   138 -rw-r-----  1 root  wheel     139720 Aug 29 00:00 
/var/log/httpd-error.log.4.gz
   114 -rw-r-----  1 root  wheel     116124 Aug 22 00:00 
/var/log/httpd-error.log.5.gz
    80 -rw-r--r--  1 root  wheel      80066 Oct  6 18:47 
/var/log/httpd-ssl_request.log

# ls -lsa /var/log/rewrite_log*
194672 -rw-r-----  1 root  wheel  199225770 Oct  7 16:07 /var/log/rewrite_log
 17856 -rw-r-----  1 root  wheel   18260862 Oct  3 00:00 
/var/log/rewrite_log.0.gz
 18448 -rw-r-----  1 root  wheel   18873604 Sep 26 00:00 
/var/log/rewrite_log.1.gz
 26288 -rw-r-----  1 root  wheel   26899244 Sep 19 00:00 
/var/log/rewrite_log.2.gz
 17536 -rw-r-----  1 root  wheel   17935781 Sep  5 00:00 
/var/log/rewrite_log.3.gz
 16896 -rw-r-----  1 root  wheel   17278330 Aug 29 00:00 
/var/log/rewrite_log.4.gz
 16048 -rw-r-----  1 root  wheel   16402215 Aug 22 00:00 
/var/log/rewrite_log.5.gz

Your problem appears to be caused by file globbing.  Since you use httpd/*, 
every file will be rotated, even ones that were previously rotated.  So, 
newsyslogd keeps appending more and more bzs to the end of the filenames, just 
as you've told it to do.

>
> 	My advice would be to not use syslog.  It's bee a while since I
> fixed this problen, but I remember reading Apache has ... issues
> ... with rotating logs using syslog/newsyslog.  Instead I use
> sysutils/cronolog with:
>

None here, and I've been rotating apache logs since 1.3.1* (now at 2.2.16 with 
numerous upgrades in between) using newsyslog without every seeing the problem 
that you describe.

-- 
Paul Schmehl, Senior Infosec Analyst
As if it wasn't already obvious, my opinions
are my own and not those of my employer.
*******************************************
"It is as useless to argue with those who have
renounced the use of reason as to administer
medication to the dead." Thomas Jefferson
"There are some ideas so wrong that only a very
intelligent person could believe in them." George Orwell