Rotating logs on Solaris with logadm

Logadm is the tool appeared in Solaris 9, and in 10 it`s the default one. I had a task to rotate Squid logs, and decided to take the generic instuments to do this - logadm & friends.

So, at first, we need to be sure, that logadm is being run on daily basis - and change this if needed:


# crontab -l
...
10 3 * * * /usr/sbin/logadm


So, each day at 1030 we`ll have logadm launched, nice.

Logadm uses /etc/logadm.conf file as it`s configuration one. You could take a look at it, to became more or less familiar with it.


# less /etc/logadm.conf
...
/var/log/syslog -C 8 -P 'Tue Oct 27 03:10:00 2009' -a 'kill -HUP `cat /var/run/syslog.pid`'
/var/adm/messages -C 4 -P 'Tue Oct 27 03:10:00 2009' -a 'kill -HUP `cat /var/run/syslog.pid`'
/var/cron/log -c -s 512k -t /var/cron/olog
...


Preferred way to add files to rotate to logadm is with -w key:


# logadm -w /apps/squid/logs/cache.log -p 1d -t '/apps/squid/logs/rotated/$basename.$n.%Y_%m_%d' -z 0


This will make Squid`s cache log rotate once per day


-p 1d


writing it`s output to


-t '/apps/squid/logs/rotated/$basename.$n.%Y_%m_%d'


numbered, and datestamped - i haven`t found this in man, and figured by myself, and compressed by gzip


-z 0


0 means, that no files will be left unzipped, i.e. if there would be 5 - that means, that last 5 logs will be non-zipped, thus making them more comfortably to process.

Pretty simple, though powerful. To take a look at logadm`s debug and command executed (pretty useful while debugging), run


# logadm -vn


In general, logadm could do an whole bunch of stuff - executing commands pre and post rotating, emailing you re what`s going one, and more. But, as always - Keep It Simple, Stupid