Rubenerd

(For some reason, every time I discuss file archiving and compression, I’ve included images of Asahina Mikuru from The Melancholy of Haruhi Suzumiya (© Kyoto Animation). Presumably because her moebeam can similarly compress files).

All good sysadmins maintain logs. In simpler setups, they’re located in your /var/log folder. Slowly accumulating, until you run out of space. That’s okay though, because your /var is mounted on its own partition or BSD slice.

Yours isn’t? Huh. What’s your IP address? ;)

Another way logfies are maintained are regular rotations. For most of my life, I’d taken it for granted that *log files appearing in /var/log seemed to archive themselves after a condition had been met, either time or space. Debian and RHEL archive to gz, FreeBSD archives to bzip2 by default. Proving once again FreeBSD is more efficient. I’ll see myself out.

For example, lets look at a testing machine I run:

auth.log
auth.log.0.xz
auth.log.1.xz

This log tracks authentication attempts. Judging from the number, its been rotated twice.

On FreeBSD, newsyslog is run by cron to archive log files before they become unwieldly. It’s enabled by default, and takes its configuration from /etc/newsyslog.conf. Let’s take a look:

# logfilename     [owner:group] mode count size when  flags [/pid_file] [sig_num]
/var/log/all.log                600  7     *    @T00  X
/var/log/amd.log                644  7     100  *     X
/var/log/auth.log               600  7     100  @0101T XC

There’s a lot here, but basically we have the logs to archive, how many rotations should be done (count), the condition for archiving (size and time), and a series of flags. As usual, the FreeBSD manpage on the topic is excellent; take that GNU info.

This is where things get more interesting. C tells it to create a logfile if it doesn’t exist, and X uses xz to compress the archives.

Wait, what? That’s right, instead of bzip2 or gzip, you can get even crazier compression by default for logfiles now. Makes me want to shed a tear, and bring back the steam roller from 2007.

This is probably [very] old news, but there’s a person born every minute who hasn’t seen *The Melancholy of Suzimiya Haruhi*.