Log Files

---

Every server writes logs that are used for various purposes. They document the availability of the server; they show the activity on the server (accesses per minute, the types of requests, the IP numbers of the originators of the requests, and the data volume requested); and they show the server's resource consumption for individual clients.

The problem with log files is that they grow. Normally, you can configure your server to specify the level of detail for the log file. Of course, increasing the level of detail in the server log results in a larger log file. System administrators are keen on destroying log files as frequently as possible. On the other hand, you may need statistics on the server usage to show to your users and sponsors. The most frequent solution to this problem is called "log file rotation." For this purpose you:

• Stop the server

• Copy the log file to a different location and compress it

• Restart the server

This strategy has several advantages:

• The log files are much smaller (log files have a compression factor of one to ten).

• You can keep online log files for a longer period of time.

• Server performance increases when the log files are smaller.

• It is easier to access a specific piece of the log. For example, suppose you have received a request for log information for a given day. There is a huge difference between e-mailing an entire 100-MB log file or a 300-kB portion of the file. Furthermore, it is much easier to extract information from a 300-kB file than a 100-MB file.

Log rotation typically is not performed by hand but by automatic procedures. Exhibit 13 shows a typical script for log-file rotation. The frequency of rotation depends on the number of accesses and how swiftly the log files grow. It is a good idea to (1) start with a weekly log-file rotation (unless you know in advance that your logs are growing very fast) and (2) control the log-file dimension daily to see if the logs are becoming too large. If the logs are bigger than 10 MB, you should rotate more frequently.

 #!/usr/bin/sh # # @(#) $Revision: 1.2 $ # # Author:          Reinhard E. Voglmaier # # Log Rotation for LDAP server # # Set the environment: PATH=/sbin:/usr/sbin:/usr/bin export PATH LOGFILE=/var/adm/ldap.log TODAY='date +%Y-%m-%d' echo "Log Rotating Facility starting: $TODAY" mv $LOGFILE $LOGFILE.$TODAY echo "Stopping LDAP Server . . ." /etc/init.d/slapd stop echo "Starting LDAP Server again . . ." /etc/init.d/slapd start echo "Compressing logfile . . ." gzip $LOGFILE.$TODAY 

Exhibit 13: Log-File Rotation Script for UNIX

Once you have set up the log-file rotation utility, you should also agree upon a log policy. You need to specify:

• How much time the log files should be maintained online on hard disk

• What to do with the log files when the online time has expired

• How long to keep saved log files (files saved to tape, CD, etc.)

These questions depend heavily on your local site policy and your user requirements. There may also be legal issues that dictate what you have to do with these log files. Indeed, the directory contains personal data, and many countries have very restrictive legal requirements protecting such data.

---