Submit Hint Search The Forums LinksStatsPollsHeadlinesRSS
14,000 hints and counting!

10.5: Allow the system.log file to be rotated daily System 10.5
Rotation of system logs is no longer managed by the daily script. Apple, in their wisdom, have assigned this duty to newsyslog, run by launchd according to the com.apple.newsyslog daemon instructions.

The default (as of 10.5.1) is that newsyslog is run by launchd at midnight every day. You might see where I am going with this one -- if your machine is off or asleep at this time, the rotation won't be run.

Now launchd will run newsyslog when you wake your machine in the morning, but the newsyslog.conf file instructs newsyslog to only rotate the system.log within an hour of the allotted time, ie midnight. All other logs (eg ftp.log, ipfw.log etc) are set to rotate when they reach a certain size, but system.log has no size limit so could grow and grow...

The easy solution is to change the following line in /etc/newsyslog.conf:
/var/log/system.log                     640  7     *    @T00  J
... to this ...
/var/log/system.log                     640  7     *    24    J
This should result in the log being rotated every 24 hours, regardless of what times your machine is awake. For more info, newsyslog and newsyslog.conf have man pages describing their function. On a related note, Lingon has been updated to Leopard status, and offers the ability to alter the times of all the launchd functions.

[robg adds: This hint was also submitted by user rflorence, who recommends using 22, 23, or 24 as the value, depending on how often/long your machine sleeps. On the queue site, user gshenaut suggests perhaps changing the system.log entry so that it, too, is rotated based on its size and not the time of day. There's definitely something wrong about the current setup -- my system.log file was 4.7M. I just changed the system to rotate the log when it reaches 900KB in size instead, and it worked as expected (the log rotated within an hour of making the edit). You'll need to use sudo to edit the file, and even then, I had to force the changes with a w! in vi.]
    •    
  • Currently 3.00 / 5
  You rated: 1 / 5 (5 votes cast)
 
[32,707 views]  

10.5: Allow the system.log file to be rotated daily | 14 comments | Create New Account
Click here to return to the '10.5: Allow the system.log file to be rotated daily' hint
The following comments are owned by whoever posted them. This site is not responsible for what they say.
10.5: Allow the system.log file to be rotated daily
Authored by: ghay on Dec 19, '07 08:24:47AM

I may have got this wrong, and I'm not at my Mac just now, but I'm fairly sure launchd in 10.4 was designed to compensate for Macs not on overnight when the /etc/*.local and cron jobs usually take place on *nix boxes.

I can't see them having removed this functionality in 10.5 and would imagine launchd still invokes these scripts when a suitable amount of idle time allows.



[ Reply to This | # ]
10.5: Allow the system.log file to be rotated daily
Authored by: sysherm on Dec 19, '07 10:14:12AM

Well, I appreciate the hint. My system.log hadn't been rotated since Nov 17 and had almost 45,000 lines. My MacBook Pro is usually asleep at midnight. Maybe Apple will fix this eventually.



[ Reply to This | # ]
10.5: Allow the system.log file to be rotated daily
Authored by: chris_on_hints on Dec 19, '07 10:41:55AM
launchd is smart enough to run the daily, weekly and monthly scripts even if it was asleep at the normal time (ie middle of the night). However, the rotation of system logs (which used to be in the daily script) are now handled by newsyslog - and the default setup for this deamon is to only rotate the system.log at midnight (with a 30min leeway either side).

if your machine sleeps before 11.30pm and wakes after 12.30am, the log will NEVER be rotated.

My suggestion was to change the newsyslog configuration file to either rotate the log once it reaches a certain size (as robg has done) or to instruct it to rotate every 24 hours (as i have done).

Note - if you want to see what newsyslog is thinking, running the following command will give you a reason for rotation or skipping of each log:

sudo /usr/sbin/newsyslog -v

[ Reply to This | # ]

launchd does not compensate skipped jobs
Authored by: wallybear on Dec 19, '07 01:17:44PM
No, launchd in 10.4 could be designed to compensate for Macs not on overnight when the /etc/*.local and cron jobs usually take place on *nix boxes, but I verified this is not the case.
I use PseudoAnacron (donationware) to automatically perform skipped daily/weekly/monthly cron jobs, and when I read about this 10.4 feature I removed the utility, only to discover that the task are not performed (like happened in Panther) if your Mac is asleep overnight. One month without PseudoAnacron resulted in one month of skipped daily, weekly and monthly cron jobs (and no, PseudoAnacron does not modify anything in the system that could prevent 10.4 to do the jobs). This still happens with 10.4.11.


[ Reply to This | # ]
10.5: Allow the system.log file to be rotated daily
Authored by: hookoa on Dec 19, '07 10:11:50AM

Doesn't the Sys Pref Pane "Macaroni" take care of this?? $9.99 and Leopard compliant.

Turn it on and don't worry.

Bill

---
"It's common knowledge among the clergy that God invented beef briskets for
Texans".
........Cactus Pryor



[ Reply to This | # ]
10.5: Allow the system.log file to be rotated daily
Authored by: ghay on Dec 19, '07 11:48:08AM

This is what happens when you start grabbing FreeBSD code!!
(Well server code and port to clients)

Apple had the forethought to run newsyslog under launchd to combat this problem, but didn't check to see that newsyslog will only rotate logs if you are within 1 hour of midnight!



[ Reply to This | # ]
10.5: Allow the system.log file to be rotated daily
Authored by: ghay on Dec 19, '07 11:51:46AM

It's worth noting that there is an interesting debate on the apple discussions forum, but it would seem newsyslog may even be run every hour, but again, rotation only occurs around midnight.



[ Reply to This | # ]
10.5: Allow the system.log file to be rotated daily
Authored by: chris_on_hints on Dec 20, '07 02:48:39PM

in the man page for newsyslog, it appears to imply that it is run every hour, but if you read it carefully it says that it *could* be run every hour because it is very light on resources.

that might be the source of the confusion



[ Reply to This | # ]
10.5: Allow the system.log file to be rotated daily
Authored by: rflorence on Dec 19, '07 12:51:28PM
Launchd actually runs newsyslog every hour, on the hour. It is because of the default configuration in /etc/newsyslog.conf and a quirk in newsyslog (it will not run a skipped event more than one hour after it was originally scheduled) that the default setup only rotates system.log within an hour of midnight.

It will work to rotate system.log by size, but Unix systems traditionally rotate system.log daily to make the search for error messages simpler.

Finally, newsyslog.conf cannot be used to rotate the other files that eventually grow unwieldy, like daily.out, weekly.out, the apache2 logs, and even fsck_hfs.log. Instead, try a script like

#!/bin/sh
# script to rotate logs

rotatelog ()
{
    log=$1
    size=`ls -l $log | awk '{print $5}'`
    if [ $size -gt 50000 ] 
    then
        bzip2 < $log > $log.0.bz2 
        chmod 0644 $log.0.bz2
        > $log
    fi
}

newlog ()
{
    log=$1
    [ -f $log.2.bz2 ] && mv $log.2.bz2 $log.3.bz2
    [ -f $log.1.bz2 ] && mv $log.1.bz2 $log.2.bz2
    [ -f $log.0.bz2 ] && mv $log.0.bz2 $log.1.bz2
    bzip2 < $log > $log.0.bz2 
    chmod 0644 $log.0.bz2
    > $log
}


cd /var/log
rotatelog daily.out
rotatelog weekly.out

cd /var/log/apache2
newlog access_log
newlog error_log
as /etc/weekly.local or /etc/monthly.local.

[ Reply to This | # ]
10.5: Allow the system.log file to be rotated daily
Authored by: adamb529 on Dec 19, '07 03:08:33PM

Wow, I would have never realized that my system log is 8.5MB! I put my computer to sleep every night, so the log has information from the day I installed Leopard! Modified using Lingon, hopefully all will be well!



[ Reply to This | # ]
10.5: Allow the system.log file to be rotated daily
Authored by: virusdoc on Dec 19, '07 06:14:59PM

For the uninitiated among us: the size of the system log file is a problem why? Is this file parsed during each login/resume/startup, therefore adding unecessary time to those processes?



[ Reply to This | # ]
10.5: Allow the system.log file to be rotated daily
Authored by: porkchop_d_clown on Dec 20, '07 05:39:31AM

Dang. A 10.0 bug rears its ugly head.

I wonder if this problem is related to getting OS X "UNIX certified"?

---
Everyone loves a clown, but no one will lend him money!



[ Reply to This | # ]
10.5: Allow the system.log file to be rotated daily
Authored by: ghay on Dec 23, '07 02:11:43PM

Nope, no confusion. If you look at the plist, it is missing an hour key, so it is run every hour. The fault here is that newsyslog isn't clever enough to do it's thing unless it's near midnight.

Launchd is working as expected.



[ Reply to This | # ]
10.5: Allow the system.log file to be rotated daily
Authored by: MAW on Nov 03, '09 10:04:24AM

As a newby mac user my question is simple. How do I access the following program, change it and re-save it.

he easy solution is to change the following line in /etc/newsyslog.conf:
/var/log/system.log 640 7 * @T00 J
... to this ...
/var/log/system.log 640 7 * 24 J

Thanks,

Mark



[ Reply to This | # ]