The syslog config file at /etc/syslog.conf states that syslog is run by ASL, but the man page indicates that newsyslog is operative and its config file is at newsyslog.conf. These indicators seem to me to be ambiguous (though I am not an expert), but I went with newsyslog.conf for reasons you'll see below.
I often refer to the FreeBSD manual since Darwin and OSX are derived from it*. The systems are not identical, but they are close enough that sometimes I can find explanations in the former that help in the latter. Since the newsyslog.conf file in 10.8.5 opens with a reference to FreeBSD, that strategy seems like it might apply in this case.
The second line in the OSX newsyslog.conf file is [1], which explicitly mentions FreeBSD. I interpret to mean that I can use references from FreeBSD in OSX. (At least I can use them until I can't.)
I went to the FreeBSD manual page at [2] and found a block quote of the newsyslog.conf file in FreeBSD that nearly mirrors the same conf file in OSX. So I assume the systems are close enough that the configuration description in the FreeBSD manual will also work for OSX. That assumption means that I can use the recommendation at the end of the following blockquote in the manual, section 12.7.2, Log Management and Rotation:
Each line starts with the name of the log to be rotated, optionally followed by an owner and group for both rotated and newly created files. The mode field sets the permissions on the log file and count denotes how many rotated log files should be kept. The size and when fields tell newsyslog when to rotate the file. A log file is rotated when either its size is larger than the size field or when the time in the when field has passed.
(For those reading in an email system which changes formatted text to plain text, the words "mode", "count", "size" and "when" are italicized, indicating they are the referenced fields.)
The next paragraph states "for more information […] and how to specify the rotation time, refer to [3]". This reference goes to man newsyslog.conf which is in OSX 10.8.5**.
This is detailed and well explained. It tells you how to read the default config settings - which are in ISO 8601 restricted time format - and how to change them. I found it very useful to read the whole thing, especially for the ISO 8601 explanation. The tl;dr version is that your current default log rotation time for syslog is 1 day because the (default) setting in the conf file is @T00. You can change that to daily, weekly or monthly by using the ISO 8601 format and simply changing the default setting to your choice.
If you are reluctant to practice your newfound ISO 8601 wizardry on a production computer, there are some examples that include the default setting and also include some weekly and monthly settings that you might like to copy and use. I think you'll find a desirable choice in the examples. These are in the man page on your OSX computer, but I'll quote them here for completeness in the Fed-talk listserv archive:
$D0 rotate every night at midnight (same as @T00)
$D23 rotate every day at 23:00 (same as @T23)
$W0D23 rotate every week on Sunday at 23:00
$W5D16 rotate every week on Friday at 16:00
$M1D0 rotate at the first day of every month at midnight
(i.e., the start of the day; same as @01T00)
$M5D6 rotate on every 5th day of month at 6:00 (same as @05T06)
You can make these changes in the conf file via the command line or with your favorite GUI text editor. You'll want to restart at least the syslog daemon, but if it were me I would restart the machine.
[1] # $FreeBSD: /repoman/r/ncvs/src/etc/newsyslog.conf,v 1.50 2005/03/02 00:40:55 brooks Exp $
* Apple's Developer pages have the man pages online also, but I find the FreeBSD pages to be easier to search as well as to read. If I can't find what I'm looking for in FreeBSD then I go to the Dev pages. **The machine I'm doing this work on is 10.8.5, which may be different from 10.9.x (Mavericks), so ymmv. But probably not. […] Confirmation: I checked my Mavericks box and the man pages are identical to 10.8.5. I assume the daemon and the conf files are identical as well.
Hope that helps.
(Note: For anybody who tries to contact me, I am no longer at the think tank. I'm now with a little airplane company. Ping me for an updated email address.)
On May 14, 2014, at 10:26 AM, John Oliver < email@hidden> wrote: So, Mavericks has changed log rotation AGAIN. Now, it appears all rotation is handled by ASL. The man pages seem to be telling me that events logged to files are rotated every day, and I can use 'ttl' to change the number of days retained. But I don't want dozens of files with one days worth of logs each... I'd like to have one file that retains a week, or maybe a month, and retain a few of those. How do I do that?
-- John Oliver
|