13.7 Rotating the Log Files

Squid always appends new entries to its log files. If your cache is busy, some of these files can become very large after a few days. Some operating systems even place limits on the size of a file (e.g., 2 GB) and return an error for writes beyond that size. To keep your log files manageable, and Squid happy, you must regularly rotate them.

Squid has a built-in feature for rotating log files. You can invoke it with the squid -k rotate command. You then tell Squid how many old copies of each file to keep with the logfile_rotate directive. For example, if you set it to 7, you'll have eight versions of each log file: the current file and seven old ones.

Old log files are renamed with numeric extensions. For example, when you execute a rotation, Squid renames log.6 to log.7, then log.5 to log.6, and so on. The current log becomes log.0, and Squid creates a new, empty file named log.

Each time you execute squid -k rotate, Squid rotates the following files: cache.log, access.log, store.log, useragent.log (if enabled), and referer.log (if enabled). Squid also creates up-to-date versions of the swap.state files. Note, however, that swap.state isn't archived with numeric extensions.

Squid doesn't rotate the log files automatically. The best way to make it happen is with a daily cron job. For example:

0 0 * * * /usr/local/squid/sbin/squid -k rotate

If you'd rather write your own scripts to manage the log files, Squid has a special mode that you'll find useful. Simply set the logfile_rotate directive to 0. Then, when you run squid -k rotate, Squid simply closes the current log files and opens new ones. This is very useful when the operating system allows you to rename files opened by another process. The following shell script illustrates the idea:

#!/bin/sh

set -e



yesterday_secs=`perl -e 'print time -43200'`

yesterday_date=`date -r $yesterday_secs +%Y%m%d`



cd /usr/local/squid/var/logs



# rename the current log file without interrupting the logging process

mv access.log access.log.$yesterday_date



# tell Squid to close the current logs and open new ones

/usr/local/squid/sbin/squid -k rotate



# give Squid some time to finish writing swap.state files

sleep 60



mv access.log.$yesterday_date /archive/location/

gzip -9 /archive/location/access.log.$yesterday_date