Log rotation is a standard practice to ensure that log files are periodically restarted so that they don’t grow without bounds. In the past, when disk space was at a premium and maximum file sizes were limited, this was an absolute necessity. For more modern systems, these constraints may be less relevant although they may continue to be a valid concern for very active systems or with verbose logging enabled. Even with abundant disk space, appropriate managing of the system logs helps ensure the system remains healthy, logs remain available for diagnostics and analysis, and operational overhead is reduced.
In Linux, the typical log rotation utility is, appropriately enough, logrotate. However, Mac OS X uses a different tool, newsyslog, to manage the log rotation responsibilities. This utility is run automatically by the OS at frequently intervals and evaluates the rules defined in its configuration file — /etc/newsyslog.conf. For the log files defined in the config, it can evaluate the need to rotate based on a number of criteria, such as file size, at a specific time, at a specific interval, etc. It can also specify additional actions to take on the rotated log, including compression of the old log, maintaining a fixed number of previous log files, setting appropriate permissions, etc. Full documentation is available in the man page for newsyslog.conf.
Each entry in the newsyslog.conf file is specified as a single line with space-delimited fields for the various options. The general format is as follows (with [] surrounding the optional fields):
logfilename [owner:group] mode count size when flags [/pid_file] [sig_num]
An example entry for rotating the named.stats log file can be specified as follows:
/var/log/named.stats 640 5 1000 * J
In the above example, the full path is specified for the target log file — /var/log/named.stats. Permissions (640) are specified in the typical Unix manner, in this case enabling read/write for the owner and read-only for the group. This log file will maintain a maximum of 5 files, removing the oldest file as newer archived logs are created. This log file is also set to rotate at a fixed size — 1000 kilobytes and can rotate at any time (“*”) this size threshold is exceeded. The “J” flag specified calls for the the older log files to be compressed (further reducing used disk space) using the bzip2 utility.
A special note for binary (not text-based) logs: by default, newsyslog will inject a line at the beginning of a file indicating when and why the log rotated. For most text-based logs, this can be easily skipped over but for binary logs this might result in an unreadable file. In this case, be sure to specify the “B” flag which suppresses the informational line from being injected.
