Nagios Fusion Log Rotation

[toodaly]

I've noticed in /usr/local/nagiosfusion/var that once per week each log is saved (e.g. poller.log-YYYYMMDD). Where is this controlled? I was looking for a file similar to nagios.cfg (log_rotation_method=w). I was just wondering if I need to create a cron job to delete files older than say 90 days. It also looks like the file is overwritten every time the cron job is executed. For example poller.log is overwritten every time poller.php is executed (30 seconds active, 270 seconds passive). If that's the case, why is there a weekly file?

Thanks.

[eloyd]

I have no answer for you, but I'm also interested in logging configuration, so I'm posting here to get future notifications of replies.

[tmcdonald]

Controlled by logrotate it seems:

Code: Select all

[root@localhost ~]# head -20 /etc/logrotate.conf
# see "man logrotate" for details
# rotate log files weekly
weekly

# keep 4 weeks worth of backlogs
rotate 4

# create new (empty) log files after rotating old ones
create

# use date as a suffix of the rotated file
dateext

# uncomment this if you want your log files compressed
#compress

# RPM packages drop log rotation information into this directory
include /etc/logrotate.d

# no packages own wtmp and btmp -- we'll rotate them here

Note the weekly and include /etc/logrotate.d lines.

Code: Select all

[root@localhost ~]# cat /etc/logrotate.d/nagiosfusion
/usr/local/nagiosfusion/var/*log {
    missingok
    notifempty
}

And this all seems to be controlled by cron:

Code: Select all

[root@localhost ~]# cat /etc/cron.daily/logrotate
#!/bin/sh

/usr/sbin/logrotate /etc/logrotate.conf >/dev/null 2>&1
EXITVALUE=$?
if [ $EXITVALUE != 0 ]; then
    /usr/bin/logger -t logrotate "ALERT exited abnormally with [$EXITVALUE]"
fi
exit 0

It does look like the cron jobs that actually writes to the logs are overwriting instead of appending:

Code: Select all

[root@localhost ~]# crontab -u nagios -l
* * * * * /usr/bin/php -q /usr/local/nagiosfusion/cron/cmdsubsys.php > /usr/local/nagiosfusion/var/cmdsubsys.log 2>&1
* * * * * /usr/bin/php -q /usr/local/nagiosfusion/cron/eventman.php > /usr/local/nagiosfusion/var/eventman.log 2>&1
* * * * * /usr/bin/php -q /usr/local/nagiosfusion/cron/sysstat.php > /usr/local/nagiosfusion/var/sysstat.log 2>&1
*/5 * * * * /usr/bin/php -q /usr/local/nagiosfusion/cron/dbmaint.php > /usr/local/nagiosfusion/var/dbmaint.log 2>&1
*/5 * * * * /usr/bin/php -q /usr/local/nagiosfusion/cron/poller.php > /usr/local/nagiosfusion/var/poller.log 2>&1

I will need to speak to the devs about this, but you can try changing to appending and see how fast the logs grow.

[eloyd]

Ah. I was looking specifically for poller.log and missed the wildcard in the logrotate. Yes, I'd rather see logs get appended to rather than overwritten. After all, not everyone has NLS.

[lmiltchev]

Yes, I'd rather see logs get appended to rather than overwritten.

I already modified the nagios' crontab on my test Fusion box, and will be monitoring it for a while to see if my poller.log will grow "out of control".

[lmiltchev]

Just to follow up - I checked the poller logs on my test Fusion box. After modifying the crontab command to use ">>":

Code: Select all

*/5 * * * * /usr/bin/php -q /usr/local/nagiosfusion/cron/poller.php >> /usr/local/nagiosfusion/var/poller.log 2>&1

the logs grew in size but not as much as I thought they would.

Code: Select all

[root@localhost var]# ll -t /usr/local/nagiosfusion/var/poller.log*
-rw-r--r--. 1 nagios nagios 338868 Jun 20 13:09 /usr/local/nagiosfusion/var/poller.log
-rw-r--r--. 1 nagios nagios 379048 Jun 19 03:09 /usr/local/nagiosfusion/var/poller.log-20160619
-rw-r--r--. 1 nagios nagios    836 Jun 12 03:29 /usr/local/nagiosfusion/var/poller.log-20160612
-rw-r--r--. 1 nagios nagios    836 Jun  5 03:29 /usr/local/nagiosfusion/var/poller.log-20160605