Product Documentation
ADC
14.1 - Current Release 13.1 13.0 12.1
View PDF

How to configure log file rotation

September 14, 2021
Contributed by: 
S S

The Citrix ADC appliance generates logs in multiple directories and in various formats. Some of these logs are not rotated by default and can grow in size consuming too much disk space. By using the included utilities for log rotation (newsyslog), you can manage these logs consistently, by keeping only relevant information for easier management and administration.

The newsyslog utility included in the Citrix ADC firmware archives log files and rotates the system logs so the current log is empty during rotation. The system crontab runs this utility every hour and it reads the configuration file which specifies the files to rotate and the conditions. The archived files might be compressed if necessary.

The existing configuration is located in /etc/newsyslog.conf. However, because this file resides in the memory filesystem, the administrator must save the modifications to /nsconfig/newsyslog.conf so the configuration survives restarting the NetScaler.

The entries contained in this file have the following format: logfilename [owner:group] mode count size when flags [/pid_file] [sig_num]

Note:

Fields within squared brackets are optional and can be omitted.

Each line on the file represents a log file and the conditions under which rotation must occur.

In the example, the size field indicates that the size of ns.log as 100 Kilobytes. The count field indicates that the number of archived ns.log files as 25. A size of 100 K and count of 25 are the default size and count values.

Note:

When the field is configured with an asterisk ( * ), meaning that the ns.log file is not rotated based on time. Every hour, a crontab job runs the newsyslog utility which checks if the size of ns.log is greater than or equal to the size configured in this file. In this example, if it is greater than or equal to 100 K, it rotates that file.

root@ns# cat /etc/newsyslog.conf
# Netscaler newsyslog.conf

# This file is present in the memory filesystem by default, and any changes
# to this file will be lost following a reboot. If changes to this file
# require persistence between reboots, copy this file to the /nsconfig
# directory and make the required changes to that file.
#
# logfilename [owner:group] mode count size when flags [/pid_file] [sig_num]
/var/log/cron 600 3 100 * Z
/var/log/amd.log 644 7 100 * Z
/var/log/auth.log 600 7 100 * Z
/var/log/ns.log 600 25 100 * Z
<!--NeedCopy-->

The size field can be changed to modify the minimum size of the ns.log file or the field can be changed to rotate the ns.log file based on a certain time.

The daily, weekly, and/or monthly specification is given as: [Dhh], and [Dhh [Mdd]], respectively. The time-of-day fields, which are optional, default to midnight. The ranges and meanings for these specifications are:

Hh hours, range 0 ... 23
w day of week, range 0 ... 6, 0 = Sunday
dd day of month, range 1 ... 31, or the letter L or l to specify the last day of the month.
<!--NeedCopy-->

Examples:

Here are some examples with explanations for the logs that are rotated by default:

/var/log/auth.log 600 7 100 * Z

The authentication log is rotated when the file reaches 100 K, the last 7 copies of the auth.log are archived and compressed with gzip (Z flag), and the resulting archives are assigned the following permissions –rw——-.

/var/log/all.log 600 7 * @T00 Z

The catch-all log is rotated 7 times at midnight every night (@T00) and compressed with gzip. The resulting archives are assigned the following permissions –rw-r—–.

/var/log/weekly.log 640 5 * $W6D0 Z

The weekly log is rotated 5 times at midnight every Monday. The resulting archives are assigned with permissions.

Common Rotation Patterns:

  • D0. rotate every night at midnight
  • D23. rotate every day at 23:00
  • W0D23. rotate every week on Sunday at 23:00
  • W5. rotate every week on Friday at midnight
  • MLD6. rotate at the last day of every month at 6:00
  • M5. rotate on every fifth day of the month at midnight

If an interval and a time specification are both given, then both conditions must be met. That is, the file must be as old as or older than the specified interval and the current time must match the time specification.

You can control the minimum file size but there is no limit on the file size before the newsyslog utility gets its turn in the next hour slot.

Debug newsyslog:

To debug the behavior of the newsyslog utility, add the verbose flag.

root@dj_ns# newsyslog -v
/var/log/cron <3Z>: size (Kb): 31 [100] --> skipping
/var/log/amd.log <7Z>: does not exist, skipped.
/var/log/auth.log <7Z>: size (Kb): 2 [100] --> skipping
/var/log/kerberos.log <7Z>: does not exist, skipped.
/var/log/lpd-errs <7Z>: size (Kb): 0 [100] --> skipping
/var/log/maillog <7Z>: --> will trim at Tue Mar 24 00:00:00 2009
/var/log/sendmail.st <10>: age (hr): 0 [168] --> skipping
/var/log/messages <5Z>: size (Kb): 7 [100] --> skipping
/var/log/all.log <7Z>: --> will trim at Tue Mar 24 00:00:00 2009
/var/log/slip.log <3Z>: size (Kb): 0 [100] --> skipping
/var/log/ppp.log <3Z>: does not exist, skipped.
/var/log/security <10Z>: size (Kb): 0 [100] --> skipping
/var/log/wtmp <3>: --> will trim at Wed Apr 1 04:00:00 2009
/var/log/daily.log <7Z>: does not exist, skipped.
/var/log/weekly.log <5Z>: does not exist, skipped.
/var/log/monthly.log <12Z>: does not exist, skipped.
/var/log/console.log <5Z>: does not exist, skipped.
/var/log/ns.log <5Z>: size (Kb): 18 [100] --> skipping
/var/log/nsvpn.log <5Z>: size (Kb): 0 [100] --> skipping
/var/log/httperror.log <5Z>: size (Kb): 1 [100] --> skipping
/var/log/httpaccess.log <5Z>: size (Kb): 1 [100] --> skipping
root@dj_ns#
<!--NeedCopy-->
How to configure log file rotation
September 14, 2021
Contributed by: 
S S
September 14, 2021
Contributed by: 
S S

In this article

Site feedback | Your privacy choices footer linkYour Privacy Choices | Privacy and legal terms | Cookie preferences | Consent settings | docs.cloud.com
© 1999- Cloud Software Group, Inc. All rights reserved.