Hi I am using Centos 5.1 and I have a weird problem with squid logs
rotation. I have the file squid as follow in /etc/logrotate.d:
Recently I reduce size parameter.
/var/log/squid/access.log {
weekly
missingok
rotate 10
compress
create 0660 squid squid
missingok
size 200M
postrotate
/usr/sbin/squid -k rotate
endscript
}
/var/log/squid/cache.log {
weekly
rotate 5
copytruncate
compress
notifempty
missingok
}
/var/log/squid/store.log {
missingok
weekly
compress
size 200M
create 0660 root squid
rotate 4
# This script asks squid to rotate its logs on its own.
# Restarting squid is a long process and it is not worth
# doing it just to rotate logs
postrotate
/usr/sbin/squid -k rotate
endscript
}
logrotate -vvv -f /etc/logrotate.d/squid
reading config file /etc/logrotate.d/squid
reading config info for /var/log/squid/access.log
reading config info for /var/log/squid/cache.log
reading config info for /var/log/squid/store.log
Handling 3 logs
rotating pattern: /var/log/squid/access.log forced from command line
(10 rotations)
empty log files are rotated, old logs are removed
considering log /var/log/squid/access.log
log needs rotating
rotating log /var/log/squid/access.log, log->rotateCount is 10
renaming /var/log/squid/access.log.10.gz to
/var/log/squid/access.log.11.gz (rotatecount 10, logstart 1, i 10),
old log /var/log/squid/access.log.10.gz does not exist
renaming /var/log/squid/access.log.9.gz to
/var/log/squid/access.log.10.gz (rotatecount 10, logstart 1, i 9),
old log /var/log/squid/access.log.9.gz does not exist
renaming /var/log/squid/access.log.8.gz to
/var/log/squid/access.log.9.gz (rotatecount 10, logstart 1, i 8),
old log /var/log/squid/access.log.8.gz does not exist
renaming /var/log/squid/access.log.7.gz to
/var/log/squid/access.log.8.gz (rotatecount 10, logstart 1, i 7),
old log /var/log/squid/access.log.7.gz does not exist
renaming /var/log/squid/access.log.6.gz to
/var/log/squid/access.log.7.gz (rotatecount 10, logstart 1, i 6),
old log /var/log/squid/access.log.6.gz does not exist
renaming /var/log/squid/access.log.5.gz to
/var/log/squid/access.log.6.gz (rotatecount 10, logstart 1, i 5),
old log /var/log/squid/access.log.5.gz does not exist
renaming /var/log/squid/access.log.4.gz to
/var/log/squid/access.log.5.gz (rotatecount 10, logstart 1, i 4),
renaming /var/log/squid/access.log.3.gz to
/var/log/squid/access.log.4.gz (rotatecount 10, logstart 1, i 3),
renaming /var/log/squid/access.log.2.gz to
/var/log/squid/access.log.3.gz (rotatecount 10, logstart 1, i 2),
renaming /var/log/squid/access.log.1.gz to
/var/log/squid/access.log.2.gz (rotatecount 10, logstart 1, i 1),
renaming /var/log/squid/access.log.0.gz to
/var/log/squid/access.log.1.gz (rotatecount 10, logstart 1, i 0),
old log /var/log/squid/access.log.0.gz does not exist
log /var/log/squid/access.log.11.gz doesn't exist -- won't try to dispose of it
renaming /var/log/squid/access.log to /var/log/squid/access.log.1
creating new log mode = 0660 uid = 23 gid = 23
running postrotate script
compressing log with: /bin/gzip
rotating pattern: /var/log/squid/cache.log forced from command line
(5 rotations)
empty log files are not rotated, old logs are removed
considering log /var/log/squid/cache.log
log needs rotating
rotating log /var/log/squid/cache.log, log->rotateCount is 5
renaming /var/log/squid/cache.log.5.gz to
/var/log/squid/cache.log.6.gz (rotatecount 5, logstart 1, i 5),
old log /var/log/squid/cache.log.5.gz does not exist
renaming /var/log/squid/cache.log.4.gz to
/var/log/squid/cache.log.5.gz (rotatecount 5, logstart 1, i 4),
old log /var/log/squid/cache.log.4.gz does not exist
renaming /var/log/squid/cache.log.3.gz to
/var/log/squid/cache.log.4.gz (rotatecount 5, logstart 1, i 3),
renaming /var/log/squid/cache.log.2.gz to
/var/log/squid/cache.log.3.gz (rotatecount 5, logstart 1, i 2),
renaming /var/log/squid/cache.log.1.gz to
/var/log/squid/cache.log.2.gz (rotatecount 5, logstart 1, i 1),
renaming /var/log/squid/cache.log.0.gz to
/var/log/squid/cache.log.1.gz (rotatecount 5, logstart 1, i 0),
old log /var/log/squid/cache.log.0.gz does not exist
log /var/log/squid/cache.log.6.gz doesn't exist -- won't try to dispose of it
copying /var/log/squid/cache.log to /var/log/squid/cache.log.1
truncating /var/log/squid/cache.log
compressing log with: /bin/gzip
rotating pattern: /var/log/squid/store.log forced from command line
(4 rotations)
empty log files are rotated, old logs are removed
considering log /var/log/squid/store.log
log needs rotating
rotating log /var/log/squid/store.log, log->rotateCount is 4
renaming /var/log/squid/store.log.4.gz to
/var/log/squid/store.log.5.gz (rotatecount 4, logstart 1, i 4),
renaming /var/log/squid/store.log.3.gz to
/var/log/squid/store.log.4.gz (rotatecount 4, logstart 1, i 3),
renaming /var/log/squid/store.log.2.gz to
/var/log/squid/store.log.3.gz (rotatecount 4, logstart 1, i 2),
renaming /var/log/squid/store.log.1.gz to
/var/log/squid/store.log.2.gz (rotatecount 4, logstart 1, i 1),
renaming /var/log/squid/store.log.0.gz to
/var/log/squid/store.log.1.gz (rotatecount 4, logstart 1, i 0),
old log /var/log/squid/store.log.0.gz does not exist
renaming /var/log/squid/store.log to /var/log/squid/store.log.1
creating new log mode = 0660 uid = 0 gid = 23
running postrotate script
compressing log with: /bin/gzip
removing old log /var/log/squid/store.log.5.gz
The strange thing is that I get the following files:
[root at fido ~]# ls -lhtr /var/log/squid
total 409M
-rw-rw---- 1 root root 323M May 26 04:21 store.log.4.gz
-rw-r--r-- 1 root root 12K Jun 11 15:40 squid.out
-rw-r--r-- 1 root root 29M Jul 7 15:58 access.log.5.gz
-rw-r----- 1 squid squid 367 Jul 8 04:22 cache.log.4.gz
-rw-r--r-- 1 squid squid 28M Jul 8 04:22 access.log.4.gz
-rw-r----- 1 squid squid 367 Jul 8 09:31 cache.log.3.gz
-rw-r----- 1 squid squid 20 Jul 8 09:31 access.log.3.gz
-rw-r----- 1 squid squid 2.9M Jul 8 09:31 store.log.3.gz
-rw-r----- 1 squid squid 1.1K Jul 8 10:21 store.log.2.gz
-rw-r----- 1 squid squid 367 Jul 8 10:21 cache.log.2.gz
-rw-r----- 1 squid squid 3.2M Jul 8 10:21 access.log.2.gz
-rw-r----- 1 squid squid 2.0K Jul 8 10:39 cache.log.1
-rw-r----- 1 squid squid 20M Jul 8 10:45 access.log.3
-rw-rw---- 1 squid squid 0 Jul 8 10:45 access.log.1
-rw-r----- 1 squid squid 3.1K Jul 8 10:45 store.log.2
-rw-rw---- 1 root squid 0 Jul 8 10:45 store.log.0
-rw-r----- 1 squid squid 359 Jul 8 10:45 cache.log.1.gz
-rw-r----- 1 squid squid 0 Jul 8 10:45 cache.log.0
-rw-r----- 1 squid squid 2.2M Jul 8 10:45 access.log.1.gz
-rw-r----- 1 squid squid 11K Jul 8 10:45 access.log.0
-rw-r----- 1 squid squid 1.4M Jul 8 10:45 store.log.1.gz
-rw-r----- 1 squid squid 1.9K Jul 8 10:45 cache.log
-rw-r----- 1 squid squid 328K Jul 8 10:46 store.log
-rw-r----- 1 squid squid 957K Jul 8 10:46 access.log
I don't understand why compress old log files but doesn't delete old
non-compressed files uncompressed. Any ideas? (I've also modified
create parameter for squid be owner of access logs and run by hand
logrotate /etc/logrotate.d/squid to see if it repeats the case)
Thanks in advance
--
--
Open Kairos http://www.openkairos.com
Watch More TV http://sebelk.blogspot.com
Sergio Belkin -