Limit log file size

Kevad · 09-27-2006, 02:05 PM

Hello,

I'm looking for a way to limit the file size of some of our log files. For instance, /var/log/messages might grow to over a few hundred megs on some of our boxes used for testing. What I'd like to do would be to limit the size of the /var/log/messages file to something like 50MB, and when additional data comes in, older data in the file is deleted.

Anyone done something similar?

Thanks,
Dave

acid_kewpie · 09-27-2006, 02:09 PM

you wouldn't delete the data, you'd rotate the logs. you should have logrotate already runnign and if you have too much going into messages, you can change the rotation logic to rotate on file size instead of age easily enough.

Kevad · 09-27-2006, 02:17 PM

Ahh..that makes sense. Didn't know you could change logrotate to use filesize instead of just at a predetermined size.

So, let me explain a little bit further...just to see if you guys have any better ideas.

We have a large number of servers that iSCSI boot to a NetApp filer (~250). So, all of these client's "local disks" are actually located on the filer. If all the log rotations kick off at the same time each night, it can cause the filer to become very busy with disk I/O for all 250 servers. I'm looking to eliminate this by either staggering the log rotation times for each of the servers, or possibly rotating based on the size.

acid_kewpie · 09-27-2006, 03:16 PM

well yes, that's doable, there's a simple example on the logrotate manpage

Code:

       "/var/log/httpd/access.log" /var/log/httpd/error.log {
           rotate 5
           mail www@my.org
           size=100k
           sharedscripts
           postrotate
                                     /sbin/killall -HUP httpd
           endscript
       }

but be careful about avoiding problems you're going to crash into in the end. if you only have a toy SAN, then you've gotta do it for now though ehh?

trickykid · 09-27-2006, 04:20 PM

Quote:

Originally Posted by Kevad

If all the log rotations kick off at the same time each night, it can cause the filer to become very busy with disk I/O for all 250 servers. I'm looking to eliminate this by either staggering the log rotation times for each of the servers, or possibly rotating based on the size.

Either do this by size or alter the time logrotate runs, but if you have a SAN that is affected by rotating logs that don't exceed 50 megs in size each and only 250 of these machines, you seriously have something wrong with your SAN and it's I/O. I've dealt with SAN's with 20 to 30 servers attached to it while production continued to load data into our Databases using this SAN without problems and reaching/maintaining 100meg or so an hour for each database.

NetApp filers should have no problem handling log file rotations with 250 servers, if they do, I'd be calling NetApp to find out what the problem is.

Kevad · 09-27-2006, 05:27 PM

Quote:

Originally Posted by trickykid

Either do this by size or alter the time logrotate runs, but if you have a SAN that is affected by rotating logs that don't exceed 50 megs in size each and only 250 of these machines, you seriously have something wrong with your SAN and it's I/O. I've dealt with SAN's with 20 to 30 servers attached to it while production continued to load data into our Databases using this SAN without problems and reaching/maintaining 100meg or so an hour for each database.

NetApp filers should have no problem handling log file rotations with 250 servers, if they do, I'd be calling NetApp to find out what the problem is.

Those were actually just some arbitrary sizes I pulled out of a hat

. Our log files are actually *very* large (>1GB/day) due to the testing being done on these boxes. (Lots of output)

Thanks for the suggestions everyone.

acid_kewpie · 09-28-2006, 03:01 AM

there is also the issue of where the logs go in the first place. again not sure exactly what the issues are but can you not work on the syslog itself and filter things more effectively if so much stuff is going into messages?