Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Whats the best way to rotate nginx logfiles? In my opinion, I should create a file "nginx" in /etc/logrotate.d/ and fill it with the following code and do a /etc/init.d/syslog restart after that.

This would be my config (I havn't tested it yet):

 /usr/local/nginx/logs/*.log {
    #rotate the logfile(s) daily
    daily
    # adds extension like YYYYMMDD instead of simply adding a number
    dateext
    # If log file is missing, go on to next one without issuing an error msg
    missingok
    # Save logfiles for the last 49 days
    rotate 49
    # Old versions of log files are compressed with gzip
    compress
    # Postpone compression of the previous log file to the next rotation cycle
    delaycompress
    # Do not rotate the log if it is empty
    notifempty
    # create mode owner group
    create 644 nginx nginx
    #after logfile is rotated and nginx.pid exists, send the USR1 signal
    postrotate
       [ ! -f /usr/local/nginx/logs/nginx.pid ] || kill -USR1 `cat
       /usr/local/nginx/logs/nginx.pid`
    endscript
 }

I have both the access.log and error.log files in /usr/local/nginx/logs/ and want to rotate both daily. Can anyone please tell me if "dateext" is correct? I want the log filename to be something like "access.log-2010-12-04". One more thing: Can I do the log rotation every day on a specific time (e.g. 11 pm)? If so, how? Thanks.

share|improve this question
    
FYI - No restart of syslog is necessary. Logrotate varies a bit from one distribution to the next, but generally runs from /etc/cron.daily rather than as a service. –  Aaron Copley Feb 13 '12 at 18:31
add comment

4 Answers

man logrotate

   dateformat format_string
          Specify  the  extension for dateext using the notation similar to strftime(3) function. Only %Y %m
          %d and %s specifiers are allowed.  The default value is -%Y%m%d. Note that also the character sep‐
          arating log name from the extension is part of the dateformat string. The system clock must be set
          past Sep 9th 2001 for %s to work correctly.  Note that the datestamps  generated  by  this  format
          must be lexically sortable (i.e., first the year, then the month then the day. e.g., 2001/12/01 is
          ok, but 01/12/2001 is not, since 01/11/2002 would sort lower while it is later).  This is  because
          when using the rotate option, logrotate sorts all rotated filenames to find out which logfiles are
          older and should be removed.

Can anyone please tell me if "dateext" is correct? I want the log filename to be something like "access.log-2010-12-04".

Insert a dateformat directive to your configuration file, something like this:

 /usr/local/nginx/logs/*.log {
    daily
    dateext
    dateformat -%Y-%m-%d
    ...

One more thing: Can I do the log rotation every day on a specific time (e.g. 11 pm)?

By default, logrotate is running via cron at 4 A.M:

/etc/cron.daily/logrotate

#!/bin/sh

/usr/sbin/logrotate /etc/logrotate.conf
EXITVALUE=$?
if [ $EXITVALUE != 0 ]; then
    /usr/bin/logger -t logrotate "ALERT exited abnormally with [$EXITVALUE]"
fi
exit 0

You can move this file to somewhere and rename to logrotate.sh, then create a new file in /etc/cron.d/ as belows:

0 23 * * * root /path/to/logrotate.sh
share|improve this answer
add comment

The value for dateext is given by the dateformat directive and defaults to %Y%m%d (year, month and day of month). You can customize it like %Y-%m-%d.

If you already have logrotate installed and working, it's probable that it runs everyday as a cron job, you just have to find it to change the time (remember that other stuff influence that, like the usage or not of anacron, but it varies to each system).

share|improve this answer
add comment

Check out cronolog, http://cronolog.org/ This should do what you need

share|improve this answer
    
Could you provide an example how to use cronolog with nginx? To me it seems as if the standard method (apache style) isn't working: access_log "| /usr/bin/cronolog /var/log/nginx/access-%Y%m%d.log" combined_host –  tback Nov 30 '11 at 10:31
    
Hi Tim, Please ask that as a new question and I am sure you will get an answer, thanks! –  AliGibbs Dec 4 '11 at 18:16
    
Hi Ali, thanks for the comment. In the meantime I found out that using cronolog with high traffic websites is a bad idea because of the additional overhead: pjkh.com/articles/2007/03/15/nginx-and-cronolog . Now I'm feeding the log to cronosplit on a daily basis. –  tback Dec 6 '11 at 13:35
add comment

You can rotate all vhosts at once:

/var/www/vhosts/*/logs/*.log { ... }
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.