Hi All,

I have added the following lines to my logrotate file to remove entries that include cmd.exe.

grep /var/log/httpd/access_log -ve "cmd.exe" > /var/tmp/httpd/access_log
mv -f /var/tmp/httpd/access_log /var/log/httpd/access_log

The problem is that Apache stops logging after these commands have been executed. Why and how do I fix the problem? At the moment I am having to restart Apache.

Thank you

Funny you should mention that, I JUST finished touching up this log entry

As your postrotate bit, have it restart apache:
postrotate
/sbin/apachectl restart
endscript
Where /sbin/apachectl is the actual location for your apachectl file

If you don't mind me askin, where did you find that above sequence?

And where are you implementing it, as prerotate?

Cool

At the moment I have this line after postrotate:

/bin/kill -HUP `cat /var/run/httpd.pid 2>/dev/null` 2> /dev/null || true

What is this line doing? Should I restart apache after this line?

Can I use "/etc/rc.d/init.d/httpd restart" to restart apache?


Someone posted those two lines on this site a long time ago.

I have included them at the top of /etc/cron.daily/logrotate

Cheers

Whoa! Ok, let's work this out a bit...

/etc/cron.dail/logrotate should be left alone. You should be creating scripts in /etc/logrotate.d/ OR editing the /etc/logrotate.conf directory. Either way, you should be using the same syntax I prefer the /etc/logrorate.d because I can safely not touch my conf file and remove/add logs to be rotated without comprimising the others.

Anyway, so onto more good stuff...

/bin/kill ....
That's taking what is possibly your pid of httpd IF you have that directive in your apache/httpd.conf file. However, it's easier to use what you suggested:
/etc/rc.d/init.d/httpd restart
The line:
/bin/kill ...
Is something you might look further into though, just to learn what's going on there. However, it's really OVERKILL and you should have no problem using an easier command to restart apache (the one you suggested).

HTH

COol

Could I also use: "service httpd restart"?

Would that do the same thing? Or am I required to use a full path for this like teeno suggested?

Also, what file are you editing under rotate.d? I'm running RH9 and I just looked there and I see a bunch of files, one of which is "httpd".

Opening this file, I find the following contents:

/var/log/httpd/*log {
missingok
notifempty
sharedscripts
postrotate
/bin/kill -HUP `cat /var/run/httpd.pid 2>/dev/null` 2> /dev/null || true
endscript
}

So let me see if I understand this...

I should go into /etc/cron.daily/logrotate and add the following line...

/usr/sbin/logrotate /etc/logrotate.d/httpd

Do I have that right? As I understand it, that means it will run logrotate (daily) using the httpd config file you said to edit?