How to replace nagios logrotate with Linux logrotate ?

[nagmoto]

I need to disable nagios' built-in logrotate in /etc/nagios/nagios.cfg due to crash incurred by deploying livestatus.
After this action, The problem is that I can no longer click through the the alert history from web GUI.

Looks like web gui expect following format to click through daily alert history

Code: Select all

[nagios@va32lnagiost01 archives]$ ls /var/log/nagios/archives/*.log|head
/var/log/nagios/archives/nagios-01-01-2015-00.log
/var/log/nagios/archives/nagios-01-02-2015-00.log
/var/log/nagios/archives/nagios-01-03-2015-00.log
/var/log/nagios/archives/nagios-01-04-2015-00.log
/var/log/nagios/archives/nagios-01-05-2015-00.log
/var/log/nagios/archives/nagios-01-06-2015-00.log
/var/log/nagios/archives/nagios-01-07-2015-00.log
/var/log/nagios/archives/nagios-01-08-2015-00.log
/var/log/nagios/archives/nagios-01-09-2015-00.log
/var/log/nagios/archives/nagios-01-10-2015-00.log
[nagios@va32lnagiost01 archives]$

So I try to simulate nagios way of rotating nagios log and filenames using Linux's logrotate.

After I disabled nagios default log rotate, I can't see the history alerts for

Following is the best I can do so far

Code: Select all

[naios@lnagiost01 archives]$ cat  /etc/logrotate.d/nagios
/var/log/nagios/nagios.log {
       olddir /var/log/nagios/archives2
       daily
       dateext
       dateformat -%m-%d-%Y-00
       missingok
       notifempty
       create 644 nagios nagios
       postrotate
        /sbin/service nagios reload > /dev/null 2>/dev/null || true
       endscript
       nocompress
       rotate 365
}
[nagios@lnagiost01 archives]$

The generated daily file name (nagios.log-08-01-2015-00) doesn't match with nagios' log file format.

Code: Select all

[nagios@lnagiost01 archives]$ ls /var/log/nagios/archives2/
nagios.log-08-01-2015-00
[nagios@lnagiost01 archives]$

How do I use Linux logrotate and still be able to display the daily alert history on any host ?

[eloyd]

Logrotate is nice, but has some limitations. One is in filename parsing and the fact that it wants to keep a limited number of files. However, like many Unix things, it has the ability to be customized. Here is what I would do (note I'm changing "rotate 365" to "rotate 1", removing "datext" from general section, and adding two lines to your postrotate section). WARNING: I have not actually tested this!!

Code: Select all

/var/log/nagios/nagios.log {
       olddir /var/log/nagios/archives2
       daily
       dateformat -%m-%d-%Y-00
       missingok
       notifempty
       create 644 nagios nagios
       postrotate
            datetime=$(date +%m-%d-%Y)
            mv nagios.log.1 /usr/local/nagios/var/archives/nagios-$datetime-00.log
            /sbin/service nagios reload > /dev/null 2>/dev/null || true
       endscript
       nocompress
       rotate 1
}

[lmiltchev]

nagmoto, have you tested the eloyd's suggestion? Any updates?

[eloyd]

"The eloyd." I like that.

[lmiltchev]

[nagmoto]

Yes, I did the test in my test server.
Thanks for the help so far

1. /etc/logrotate.d/nagios

Code: Select all

/var/log/nagios/nagios.log {
       olddir /var/log/nagios/archives2
       daily
       missingok
       notifempty
       create 644 nagios nagios
       nocompress
       rotate 1
       postrotate
        datetime=$(date +%m-%d-%Y)
        mv   nagios.log.1 /var/log/nagios/archives2/nagios-$datetime-00.log
        /usr/bin/systemctl reload  nagios > /dev/null 2>/dev/null || true
       endscript
}

2. Here is the debug output

Code: Select all

[root@nagiost01 nagios]# logrotate -df  /etc/logrotate.d/nagios
reading config file /etc/logrotate.d/nagios
reading config info for /var/log/nagios/nagios.log
olddir is now /var/log/nagios/archives2

Handling 1 logs

rotating pattern: /var/log/nagios/nagios.log  forced from command line (1 rotations)
olddir is /var/log/nagios/archives2, empty log files are not rotated, old logs are removed
considering log /var/log/nagios/nagios.log
  log needs rotating
rotating log /var/log/nagios/nagios.log, log->rotateCount is 1
dateext suffix '-20150803'
glob pattern '-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]'
renaming /var/log/nagios/archives2/nagios.log.1 to /var/log/nagios/archives2/nagios.log.2 (rotatecount 1, logstart 1, i 1),
renaming /var/log/nagios/archives2/nagios.log.0 to /var/log/nagios/archives2/nagios.log.1 (rotatecount 1, logstart 1, i 0),
renaming /var/log/nagios/nagios.log to /var/log/nagios/archives2/nagios.log.1
creating new /var/log/nagios/nagios.log mode = 0644 uid = 492 gid = 488
running postrotate script
running script with arg /var/log/nagios/nagios.log: "
        datetime=$(date +%m-%d-%Y)
        mv   nagios.log.1 /var/log/nagios/archives2/nagios-$datetime-00.log
        /sbin/service nagios reload > /dev/null 2>/dev/null || true
"
removing old log /var/log/nagios/archives2/nagios.log.2
[root@nagiost01 nagios]#

3. I had to use touch to create nagios.log.1 and nagios.log.2 file to get above output without error message.
but 2. did not create expected /var/log/nagios/archives2/nagios-08-03-15-00.log file in /var/log/nagios/archives2/

Code: Select all

[root@nagiost01 nagios]# ls -l /var/log/nagios/archives2/
total 0
-rw-r--r-- 1 nagios nagios 0 Aug  3 12:02 nagios.log.1
-rw-r--r-- 1 nagios nagios 0 Aug  3 11:58 nagios.log.2
[root@nagiost01 nagios]#

4. Here is what happened if removed nagios.log.1 and 2

Code: Select all

[root@nagiost01 nagios]# logrotate -df  /etc/logrotate.d/nagios
reading config file /etc/logrotate.d/nagios
reading config info for /var/log/nagios/nagios.log
olddir is now /var/log/nagios/archives2

Handling 1 logs

rotating pattern: /var/log/nagios/nagios.log  forced from command line (1 rotations)
olddir is /var/log/nagios/archives2, empty log files are not rotated, old logs are removed
considering log /var/log/nagios/nagios.log
  log needs rotating
rotating log /var/log/nagios/nagios.log, log->rotateCount is 1
dateext suffix '-20150803'
glob pattern '-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]'
renaming /var/log/nagios/archives2/nagios.log.1 to /var/log/nagios/archives2/nagios.log.2 (rotatecount 1, logstart 1, i 1),
renaming /var/log/nagios/archives2/nagios.log.0 to /var/log/nagios/archives2/nagios.log.1 (rotatecount 1, logstart 1, i 0),
renaming /var/log/nagios/nagios.log to /var/log/nagios/archives2/nagios.log.1
creating new /var/log/nagios/nagios.log mode = 0644 uid = 492 gid = 488
running postrotate script
running script with arg /var/log/nagios/nagios.log: "
        datetime=$(date +%m-%d-%Y)
        mv   nagios.log.1 /var/log/nagios/archives2/nagios-$datetime-00.log
        /usr/bin/systemctl reload  nagios > /dev/null 2>/dev/null || true
"
removing old log /var/log/nagios/archives2/nagios.log.2
error: error opening /var/log/nagios/archives2/nagios.log.2: No such file or directory
[root@nagiost01 nagios]#

[eloyd]

At this point, I would do what most people would do and ditch logrotate and just do the following script as a cron job:

Code: Select all

#!/bin/sh
datetime=$(date +%m-%d-%Y)
cd /usr/local/nagios/var
mv nagios.log archives/nagios-$datetime-00.log
/sbin/service nagios reload

There, you're done. No logrorate needed. Run the job at midnight.

[lmiltchev]

I haven't tried this, but it looks like a good workaround. It should work just fine. Thanks, eloyd!