I've come to like date-based names for log rotation
One of the divides in Linux distributions is how they set up logrotate, especially including how they have logrotate name the 'rotated' copies of logs. Ubuntu (and I assume Debian) use the traditional approach of numbered old log files, where the most recently rotated log file has a .0 suffix, the next most recent has a .1 suffix, and so on back to however many versions you want to keep. A while back, Red Hat Enterprise and thus Fedora switched to date-based naming, where the suffix is based on the day that the log was rolled and you get names like 'cron-20210530'.
(Both naming schemes often then compress the rotated logs. Sometimes the most recently rotated log, the '.0' log, is left uncompressed, partly in case something is still writing to it.)
This is usually set in /etc/logrotate.conf
as a global option.
As covered in the manpage, number
based rotation is the default and to get date based names you set
at least dateext
and possibly some of the other date-related
options. Conveniently, logrotate properly names logs you rotate
hourly instead of daily or weekly without you have to mess around
with dateformat
.
(This is what logrotate really should do, but as a system administrator I'm often a cynic about whether programs will do the better but somewhat more difficult thing or throw it in your lap.)
At first I didn't like what Red Hat and Fedora had done with the switch to date-based extensions, primarily because it made it harder to look at the most recently rotated full log file, or more broadly yesterday's log file or last week's log file. In a number based version that's always '.0' (and then '.1' and so on), but in the date based version it has a variable name. However, over time I've come to appreciate the good sides of the date based naming. In date based naming a given rotated logfile always has the same name so you can come back to it later, instead of getting constantly renumbered over time, and it's easy to know what rotated log file to look at to search over a particular date range.
Periodically I know that something happened, say, last Thursday, and I
need to look at logs for it. In the number based naming I need to use
'ls -lt
' (and possibly a calendar) to work out what file to look at,
and if I need to re-check it tomorrow I'll have to go through the whole
process again. With date based naming, it's right there and it's always
got the same name. Given a long enough retention time, I can write up a
simple description of how I searched for some information, and then in a
few days or a week or two, other people can still readily reproduce it.
They could do the same thing with number based naming, but it would need
the extra step of 'first find the log file for ...'.
I'm not going to propose we switch our regular Ubuntu servers to date based logging. We're used to the current state of affairs and there are advantages to following the distribution's standard. But someday we're going to replace our current CentOS based central syslog server with an Ubuntu based one (because of CentOS developments, also), and when we do I'm definitely going to advocate for setting it up with date-based log rotation.
|
|