We got caught recently with a request to review the ODSEE access at 12:00:00 on 5.7.2012. Our out-of-the box access log configuration gave us a month (so I thought) of access history. The log parameters are:-
bash-3.2$ /opt/sfw/bin/sudo /opt/odsee/dsee7/bin/dsconf get-log-prop -h localhost -p 389 access
Enter "cn=Directory Manager" password:
buffering-enabled : on
enabled : on
level : default
max-age : 1M
max-disk-space-size : 500M
max-file-count : 10
max-size : 100M
min-free-disk-space-size : 5M
path : /opt/stmdirs/stmldap1/logs/access
perm : 600
rotation-interval : 1d
rotation-min-file-size : unlimited
rotation-time : undefined
verbose-enabled : N/A
This I gather means a maximum log file size of 500 Mb which may be spread over 10 files.
We have negotiated with the providers of the host machine to get 10GB of their disk we can use for logs. I hope to split this 7GB for access and 3GB for errors. 1 month max age is acceptable.
What would be the "best" settings to achieve this?? Any advice welcomed.
the official product documentation says that:
max-disk-space-size: This property defines the maximum disk space the specified type of log is allowed to consume. When the limit is reached, the server deletes the oldest log file to reclaim disk space.
note the words "the specified type of logs".
This means thatis you set:
$ dsconf set-log-prop ACCESS max-disk-space-size:7G
you set the 7 gigabytes limit for the access log; as well as, if you set
$ dsconf set-log-prop ERROR max-disk-space-size:3G
you set the 3 gigabytes limit for the error log.
Ok. one setting fixes the total log size.
So what I should do for access logging is to have
total size = 7GB
held in 10 files
each file 650MB
what confuses me now is the rotations.
If the system is tracking the log by size and filling up each file one by one and switching to next when log file size reaches 650Mb what value is there for a rotation or even max age?