[squid-users] squid logs not rotating

[Amos Jeffries]

On 17/04/2015 7:45 p.m., Gary Woodman wrote:
> Greetings!
> 
> We have a couple of instances of squid to service our students' Internet access.
> 
> Squid version is:
> Squid Cache: Version 3.4.10
> We use the pre-packaged Red Hat binary from http://www1.ngtech.co.il/repo/centos/, as linked to from the squid wiki, as the Red Hat version is rather old.
> 
> The two instances are effectively identical; they are not peered, we just use round-robin DNS. We have a script to sync the configs (barring obvious things like tcp_outgoing_address and visible_hostname).
> 
> The first system, I'll call T1, functions fine and specifically, the logging behaves as expected and like all our other squid instances. We have "log_rotate 30" to keep 30 days of logs, and "squid -k rotate" at midnight via cron. The rotate renumbers all the logs, and squid starts writing in a new access.log. This is our main interest, as data from access logs feeds our quotaing and other usage reports.
> 
> The second system, T2, has the same setup and while it renumbers the logs all right, it doesn't close them or start writing in new ones. Thus we see a succession of zero-length access.logs, eventually access.log.29 reaches over 3 gigabytes, and on the next rotation, the whole lot is thrown away and squid finally starts writing in a fresh access.log, which gradually works its way up to access.log.29 again in the next log_rotate cycle. This is rather disadvantageous, as most of the time there will not be 30 days worth of data in the logs like on T1.
> 
> Other logs such as cache.log and store.log suffer equally the same buildup and wipe.
> 
> Does anyone have any suggestions? How might we go about debugging this situation?

I'd almost guarantee you the log rotation script is different on the two
servers.

Most systems use the OS provided log rotation service, which does the
rotate atomically then runs squid -k rotate. squid.conf has
"logfile_rotate 0" to prevent Squid touching the OS rotation numbering.

What you describe is classic symptoms of the OS rotating logs, but only
doing the "squid -k rotate" action once every month.


HTH
Amos