Compress logs rotated with cronolog

Question

I have a bunch of servers(Centos 5.x) with Apache that have their logs rotated with cronolog. What is the best strategy for compressing and deleting those logs automatically after a certain time? CustomLog "|/usr/sbin/cronolog /var/log/httpd/my.examplehost.com/access_log-%Y%m%d" common

I was thinking of creating a cron script that just says

gzip /var/logs/httpd/my.examplehost.com/*

But doesn't that also try to compress the file the apache is currently writing to? On cronolog homepage there is only mention that you should write your on cron jobs or similar but no instructions on how to do that.

Is there any reason why you can't use [logrotate](http://linux.die.net/man/8/logrotate) which will do what you want natively ? — user9517, Jul 27 '12 at 08:14
That's how our servers are set up with. Lots of other software rotate logs also without logrotate, for example Tomcat, so solution to this could also solve those. — palto, Jul 27 '12 at 10:25

score 3 · Accepted Answer · answered Jul 27 '12 at 15:54

3

Logrotate really is the tool for this job but if you can't use it then you could use find and the -ctime patameter

find /var/logs/httpd/my.example.host.com/ -ctime +0 -not -name '*.gz' -exec gzip {} \;

should do what you want as it finds files that were changed >24hours ago that arean't already compressed and compresses them.

To ensure the file you are working on isn't still open you could do something like

#!/bin/bash
for file in $(find /var/logs/httpd/my.example.host.com/ -ctime +0 -not -name '*.gz')
do
    lsof | grep $file
    if [$? -eq 1 ]
    then
        gzip $file
    fi
done

answered Jul 27 '12 at 15:54

user9517

114,104
20
206
289

Great, I didn't know you could set -not on the find parameters! But it seems like it isn't necessary because gzip detects files that are already compressed. I ended up modifying your script to compress files that are a week old saved it under /etc/cron.daily/ to run it every night. Works great. – palto Jul 29 '12 at 19:13
I don't think that `-ctime +0` is correct to say 24 hours. It should be `-ctime 1`. «File's status was last changed n*24 hours ago.» from `man find`. – Valerio Bozzolan Sep 28 '20 at 15:24

Compress logs rotated with cronolog

1 Answers1