The newsyslog utility included with the NetScaler firmware, archives log files, if necessary, and rotates the system logs so the current log is empty when rotation occurs. The system crontabruns this utility every hour and it reads the configuration file which specifies the files to rotate and the conditions. The archived files may be compressed if required.
The existing configuration is located in /etc/newsyslog.conf. However, because this file resides in the memory filesystem, the administrator must save the modifications to /nsconfig/newsyslog.conf so the configuration survives restarting the NetScaler.
The entries contained in this file have the following format:
logfilename [owner:group] mode count size when flags [/pid_file] [sig_num]
Note: Fields within squared brackets are optional and can be omitted.
Each line on the file represents a log file that should be handled by the newsyslog utility and the conditions under which rotation should occur.
For example, following is a highlighted entry taken from the newsyslog.conf file. In this entry, the size field indicates that the size of the file ns.log is 100 Kilobytes and the count field indicates that the number of archived ns.log files is 25. A size of 100K and count of 25 are the default size and count values.
Note that the when field is configured with an asterisk ( * ), meaning that the ns.log file is not rotated based on time. Every hour, a crontab job runs the newsyslog utility which checks if the size of ns.log is greater than or equal to the size configured in this file. In this example, if it is greater than or equal to 100K, it rotates that file.
root@ns# cat /etc/newsyslog.conf# Netscaler newsyslog.conf# This file is present in the memory filesystem by default, and any changes# to this file will be lost following a reboot. If changes to this file# require persistence between reboots, copy this file to the /nsconfig# directory and make the required changes to that file.## logfilename [owner:group] mode count size when flags [/pid_file] [sig_num]/var/log/cron 600 3 100 * Z/var/log/amd.log 644 7 100 * Z/var/log/auth.log 600 7 100 * Z/var/log/ns.log 600 25 100 * Z
The size field can be changed to modify the minimum size of the ns.log file or the when field can be changed to enable rotating the ns.log file based on a certain time.
The daily, weekly, and/or monthly specification is given as: [Dhh], [Dhh [Ww]] and [Dhh [Mdd]], respectively. The time-of-day fields, which are optional, default to midnight. The ranges and meanings for these specifications are:
Hh hours, range 0 … 23
w day of week, range 0 … 6, 0 = Sunday
dd day of month, range 1 … 31, or the letter L or l to specify the last day of the month.
Here are some examples with explanations for the logs that are rotated by default:
/var/log/auth.log 600 7 100 * Z
The authentication log is rotated when the file reaches 100K, the last 7 copies of the auth.log are archived and compressed with gzip (Z flag), and the resulting archives are assigned the following permissions –rw——-.
/var/log/all.log 600 7 * @T00 Z
The catch-all log is rotated 7 times at midnight every night (@T00) and compressed with gzip. The resulting archives are assigned the following permissions –rw-r—–.
/var/log/weekly.log 640 5 * $W6D0 Z
The weekly log is rotated 5 times at midnight every Monday. The resulting archives are assigned the following permissions –rw-r—–.
Common Rotation Patterns
D0: rotate every night at midnight
D23: rotate every day at 23:00
W0D23: rotate every week on Sunday at 23:00
W5: rotate every week on Friday at midnight
MLD6: rotate at the last day of every month at 6:00
M5: rotate on every 5th day of month at midnight
If an interval and a time specification are both given, then both conditions must be met. That is, the file must be as old as or older than the specified interval and the current time must match the time specification.
The minimum file size can be controlled, but there is no limit on how large the size of the file can be before newsyslog utility gets its turn in the next hour slot.
To debug the behavior of the newsyslog utility, add the verbose flag.
root@dj_ns# newsyslog -v/var/log/cron <3Z>: size (Kb): 31  --> skipping/var/log/amd.log <7Z>: does not exist, skipped./var/log/auth.log <7Z>: size (Kb): 2  --> skipping/var/log/kerberos.log <7Z>: does not exist, skipped./var/log/lpd-errs <7Z>: size (Kb): 0  --> skipping/var/log/maillog <7Z>: --> will trim at Tue Mar 24 00:00:00 2009/var/log/sendmail.st <10>: age (hr): 0  --> skipping/var/log/messages <5Z>: size (Kb): 7  --> skipping/var/log/all.log <7Z>: --> will trim at Tue Mar 24 00:00:00 2009/var/log/slip.log <3Z>: size (Kb): 0  --> skipping/var/log/ppp.log <3Z>: does not exist, skipped./var/log/security <10Z>: size (Kb): 0  --> skipping/var/log/wtmp <3>: --> will trim at Wed Apr 1 04:00:00 2009/var/log/daily.log <7Z>: does not exist, skipped./var/log/weekly.log <5Z>: does not exist, skipped./var/log/monthly.log <12Z>: does not exist, skipped./var/log/console.log <5Z>: does not exist, skipped./var/log/ns.log <5Z>: size (Kb): 18  --> skipping/var/log/nsvpn.log <5Z>: size (Kb): 0  --> skipping/var/log/httperror.log <5Z>: size (Kb): 1  --> skipping/var/log/httpaccess.log <5Z>: size (Kb): 1  --> skippingroot@dj_ns#