Dec 19, '07 07:30:09AM • Contributed by: chris_on_hints
Rotation of system logs is no longer managed by the daily script. Apple, in their wisdom, have assigned this duty to newsyslog, run by launchd according to the com.apple.newsyslog daemon instructions.
The default (as of 10.5.1) is that newsyslog is run by launchd at midnight every day. You might see where I am going with this one -- if your machine is off or asleep at this time, the rotation won't be run.
Now launchd will run newsyslog when you wake your machine in the morning, but the newsyslog.conf file instructs newsyslog to only rotate the system.log within an hour of the allotted time, ie midnight. All other logs (eg ftp.log, ipfw.log etc) are set to rotate when they reach a certain size, but system.log has no size limit so could grow and grow...
The easy solution is to change the following line in /etc/newsyslog.conf:
/var/log/system.log 640 7 * @T00 J
... to this ...
/var/log/system.log 640 7 * 24 J
This should result in the log being rotated every 24 hours, regardless of what times your machine is awake. For more info, newsyslog and newsyslog.conf have man pages describing their function. On a related note, Lingon has been updated to Leopard status, and offers the ability to alter the times of all the launchd functions.
[robg adds: This hint was also submitted by user rflorence, who recommends using 22, 23, or 24 as the value, depending on how often/long your machine sleeps. On the queue site, user gshenaut suggests perhaps changing the system.log entry so that it, too, is rotated based on its size and not the time of day. There's definitely something wrong about the current setup -- my system.log file was 4.7M. I just changed the system to rotate the log when it reaches 900KB in size instead, and it worked as expected (the log rotated within an hour of making the edit). You'll need to use sudo to edit the file, and even then, I had to force the changes with a w! in vi.]
