What Log Rotation Scheme Should I Use for ICAgent to Collect Logs?

Log rotation, also known as log splitting, is used to control the size of a log file. As software system runs for a long time without interrupting services, a large amount of information will be recorded in different logs. As time goes by, the limited disk space will be insufficient to accommodate the increasing log volume. In this case, the size of log files needs to be controlled.

Log rotation can be implemented by time or by log size.

• By time: Logs are rotated based on time. When the time when a log is generated reaches the specified time threshold, the log will be rotated. For example, the /var/log/messages logs are split based on the rule of rotating once every seven days.
• By log size: Logs are rotated based on the log size. When the log size reaches the specified value, the log will be rotated. This mode is applicable to application logs.

When using log rotation, you are advised to:

• Methods:

  ICAgent does not rotate your logs. You are advised to use mature software packages to customize log rotation rules in applications, such as Java logback, log4j2, Python logging, and Linux logrotate. If the size of a typical configuration log file exceeds 100 MB, 50 MB, or 20 MB, the log file is rotated once and 10 to 20 historical log files are saved.

• Suggestions on naming rotated log files:

  Assume that your log file path is /your/log/path/**/*.log. You are advised to name the rotated file as /your/log/path/**/*.xxx.log. xxx refers to the date according to user habits, for example, 20240103. It cannot contain letters.

  Custom rotation rule: If your naming rules of rotated log files do not comply with the preceding suggestion, rotated log files may be collected repeatedly. You can customize rotation rules to avoid this problem. You can add a custom rotation rule for each log collection path for matching the names of the rotated files. A file whose name matches the rule is identified as a rotated log file and will not be collected repeatedly. For example, if your log file is /your/log/path/**/app1.log and the rotated file is /your/log/path/**/app1.20240103.biz.log, you can set the rotation rule to {basename}\.[0-9-\.]+\.[0-9]+\.biz\.log.

• Compress rotated log files is not recommended.

  If your log printing rate is high, the log file will be rotated quickly. In this case, a few logs may not be collected at the end of the rotated file. ICAgent uses the Linux inode to identify the uniqueness of the collected file. If the rotated log file is a compressed file, the inode changes. As both the log file name and inode are changed, ICAgent may not be able to collect the logs that are not collected at the end of the rotation file.

  Assume that the rotated file is compressed and the file name is /your/log/path/**/*.log.xxx.zip. If both the file name and inode change, ICAgent may not be able to collect the logs that are not collected at the end of the rotation file.