Rudder

I don't know if this is an architecture ticket or a bug. To not have it could be harmful on a system with a lot of errors and/or in a debug mode (i.e: oops, i've forgot to remove the debug mode) in a limited partition.

What's your opinion?

Well, seems like a bug. We should compress old logs.

Our log rotation are handled by Jetty, not directly by Rudder web app. We can configure it to do compression by adding ".gz" at the end of the target file name in /opt/rudder/jetty7/etc/jetty-logging.xml

See: http://stackoverflow.com/questions/3329385/compress-log4j-files
(it's the same solution for more recent Jetty version that uses SLF4J).

Some more explanation on that one:

- log4j need "copytruncate"
- "copytruncate" can loose logs, see: http://serverfault.com/questions/292513/when-to-use-delaycompress-option-in-logrotate

So we will manage both log rotation and compression on log4j.

See also #3922 and #3923 for more information about delaycompress.

This will not be done in 2.8.0, and is postponed to later version

OK, another approach is needed: none of the log rotation tools seem useful here. All we want to do is gzip the files that have already been rotated. Let's just add a CFEngine bundle to find the files logname.log.[0-9]+$ (and not .gz) and run gzip on them, using CFEngine's "transformer" action on files.

See https://github.com/Normation/rudder-techniques/blob/master/techniques/system/inventory/1.0/fusionAgent.st#L537 for an example.

Problem is, Jetty does not actually "rotate" the files in its log directory, it just changes the log filename everyday as the log name contains the date, and thus opens a new file to log in it instead. (It's more like jumping from file to file instead of always logging to the same place and putting old logs aside).

• The current log file name is not fixed
• There is no specific pattern to identify old logs (no .1, .2, ...)

Basically, we just have a bunch of files with the same pattern, and even as humans have to guess the good name for the current log file when we need to access it...

• Rely on an external script to do the compression (cronjob run only on webapp server roles ?)
• Switch to Jetty 9, that enables us to specify the logging framework: http://www.eclipse.org/jetty/documentation/current/configuring-logging.html

What do ? :D

Well, as my previous comment explained it, I'm just going to copy/paste:

Let's just add a CFEngine bundle to find the files logname.log.[0-9]+$ (and not .gz) and run gzip on them, using CFEngine's "transformer" action on files.

See https://github.com/Normation/rudder-techniques/blob/master/techniques/system/inventory/1.0/fusionAgent.st#L537 for an example.

I understand that the filenames don't match the ones described, but if they contain dates, I'm sure we can somehow select any files older than today.

PR https://github.com/Normation/rudder-techniques/pull/623

Applied in changeset policy-templates:commit:541cdf0885e4415f187d23ea938de04ce4b0c3b0.

This bug has been fixed in Rudder 2.10.10 and 2.11.7, which were these days.

• Announcement 2.10 2.11
• Changelog 2.10 2.11
• Download information: https://www.rudder-project.org/site/get-rudder/downloads/