27.5. logroll

A few of the logs on my system grow quite quickly. Having to manually check the size of these logs for file sizes and then roll over the log (usually with a data stamp) gets tedious. Therefore I decided it was time I set up a script to do this automatically. The script would run from cron, and if any of the logs reached a certain size, the guilty log would be rolled over and a new log file created.

The script can easily be amended to suit other logs. For my system logs, I use another script, which is run once a week and truncates the log files. If I need to go back over any period I just check my backup; as I run a 16-week cycle this is no problem.

A size limit is defined in the variable BLOCK_LIMIT. This figure is the block size, which I have set to eight which is 4K. You can set yours higher if need be. All the logs I want to be checked are held in the variable LOGS.

A for loop then loops through this variable checking each log file, using the du command, and the size of the log is obtained. If the size is greater than BLOCK_LIMIT, the log will be copied with a date stamp appended to the file. The original log file is then zeroed, and the files group ownership is changed.

The script is run from cron a couple of times per week, creating a backup of the file with a date stamp, which ensures I can back track quickly if there are any problems that I need to check out.

						$ pg logroll 
#!/bin/sh 
# logroll 
# roll over the log files if sizes have reached the MARK 
# could also be used for mail boxes ? 
# limit size of log 
# 4096 k 
BLOCK_LIMIT=8 

MYDATE=`date +%d%m` 
# list of logs to check...yours will be different! 
LOGS="/var/spool/audlog /var/spool/networks/netlog /etc/dns/named_log" 
for LOG_FILE in $LOGS 
do 
  if [ -f $LOG_FILE ] ; then 
    # get block size 
    F_SIZE=`du -a $LOG_FILE | cut -f1` 
  else 
    echo "`basename $0` cannot find $LOG_FILE" >&2 
    # could exit here, but I want to make sure we hit all 
    # logs 
    continue 
  fi 

  if [ "$F_SIZE" -gt "$BLOCK_LIMIT" ]; then 
    # copy the log across and append a ddmm date on it 
    cp $LOG_FILE $LOG_FILE$MYDATE 
    # create / zero the new log 
    >$LOG_FILE 
    chgrp admin $LOG_FILE$MYDATE 
  fi 
done