Ротация логов (Руководство по GNU Guix)

11.10.3 Ротация логов

Log files such as those found in /var/log tend to grow endlessly, so it’s a good idea to rotate them once in a while—i.e., archive their contents in separate files, possibly compressed. The (gnu services admin) module provides an interface to the log rotation service provided by the Shepherd (see Log Rotation in The GNU Shepherd Manual).

This log rotation service is made available through log-rotation-service-type, which takes a log-rotation-configuration record has its value. By default, this provides log-rotation, a Shepherd “timed service” that runs periodically—once a week by default. It automatically knows about the log files produced by Shepherd services and can be taught about external log files. You can inspect the service and see when it’s going to run the usual way:

$ sudo herd status log-rotation
Status of log-rotation:
  It is running since Mon 09 Dec 2024 03:27:47 PM CET (2 days ago).
  …

Upcoming timer alarms:
  Sun 15 Dec 2024 10:00:00 PM CET (in 4 days)
  Sun 22 Dec 2024 10:00:00 PM CET (in 11 days)
  Sun 29 Dec 2024 10:00:00 PM CET (in 18 days)

You can also list files subject to rotation with herd files log-rotation and trigger rotation manually with herd trigger log-rotation.

This service is part of %base-services, and thus enabled by default, with the default settings.

Variable: log-rotation-service-type: This is the type of the log rotation service. Its associated value must be a log-rotation-configuration record, as discussed below.

Data Type: log-rotation-configuration

Available log-rotation-configuration fields are:

provision (default: (log-rotation)) (type: list-of-symbols): The name(s) of the log rotation Shepherd service.
requirement (default: (user-processes)) (type: list-of-symbols): Dependencies of the log rotation Shepherd service.
calendar-event (type: gexp): Gexp containing the calendar event when log rotation occurs. See Timers in The GNU Shepherd Manual, for more information on calendar events.
external-log-files (default: ()) (type: list-of-strings): List of file names, external log files that should also be rotated.
compression (default: zstd) (type: symbol): The compression method used for rotated log files, one of 'none, 'gzip, and 'zstd.
expiry (type: gexp-or-integer): Age in seconds after which a log file is deleted.
size-threshold (type: gexp-or-integer): Size in bytes below which a log file is not rotated.

Rottlog

An alternative log rotation service relying on GNU Rot[t]log, a log rotation tool (see GNU Rot[t]log Manual), is also provided.

Внимание: The Rottlog service presented here is deprecated in favor of log-rotation-service-type (see above). The rottlog-service-type variable and related tools will be removed after 2025-06-15.

The example below shows how to extend it with an additional rotation, should you need to do that (usually, services that produce log files already take care of that):

(use-modules (guix) (gnu))
(use-service-modules admin)

(define my-log-files
  ;; Log files that I want to rotate.
  '("/var/log/something.log" "/var/log/another.log"))

(operating-system
  ;; …
  (services (cons (simple-service 'rotate-my-stuff
                                  rottlog-service-type
                                  (list (log-rotation
                                         (frequency 'daily)
                                         (files my-log-files))))
                  %base-services)))

Variable: rottlog-service-type

This is the type of the Rottlog service, whose value is a rottlog-configuration object.

Other services can extend this one with new log-rotation objects (see below), thereby augmenting the set of files to be rotated.

This service type can define mcron jobs (see Запланированное исполнения задач) to run the rottlog service.

Data Type: rottlog-configuration

Data type representing the configuration of rottlog.

rottlog (default: rottlog): The Rottlog package to use.
rc-file (default: (file-append rottlog "/etc/rc")): The Rottlog configuration file to use (see Mandatory RC Variables in GNU Rot[t]log Manual).
rotations (default: %default-rotations): A list of log-rotation objects as defined below.
jobs: This is a list of gexps where each gexp corresponds to an mcron job specification (see Запланированное исполнения задач).

Data Type: log-rotation

Data type representing the rotation of a group of log files.

Taking an example from the Rottlog manual (see Period Related File Examples in GNU Rot[t]log Manual), a log rotation might be defined like this:

(log-rotation
  (frequency 'daily)
  (files '("/var/log/apache/*"))
  (options '("storedir apache-archives"
             "rotate 6"
             "notifempty"
             "nocompress")))

The list of fields is as follows:

frequency (default: 'weekly): The log rotation frequency, a symbol.
files: The list of files or file glob patterns to rotate.
options (default: %default-log-rotation-options): The list of rottlog options for this rotation (see Configuration parameters in GNU Rot[t]log Manual).
post-rotate (default: #f): Either #f or a gexp to execute once the rotation has completed.

Variable: %default-rotations: Specifies weekly rotation of %rotated-files and of /var/log/guix-daemon.log.

Variable: %rotated-files: The list of syslog-controlled files to be rotated. By default it is: '("/var/log/messages" "/var/log/secure" "/var/log/debug" \ "/var/log/maillog").

Some log files just need to be deleted periodically once they are old, without any other criterion and without any archival step. This is the case of build logs stored by guix-daemon under /var/log/guix/drvs (see Вызов guix-daemon). The log-cleanup service addresses this use case. For example, %base-services (see Базовые службы) includes the following:

;; Periodically delete old build logs.
(service log-cleanup-service-type
         (log-cleanup-configuration
          (directory "/var/log/guix/drvs")))

That ensures build logs do not accumulate endlessly.

Variable: log-cleanup-service-type: This is the type of the service to delete old logs. Its value must be a log-cleanup-configuration record as described below.

Data Type: log-cleanup-configuration

Data type representing the log cleanup configuration

directory: Name of the directory containing log files.
expiry (default: (* 6 30 24 3600)): Age in seconds after which a file is subject to deletion (six months by default).
schedule (default: "30 12 01,08,15,22 * *"): Schedule of the log cleanup job written either as a string in traditional cron syntax or as a gexp representing a Shepherd calendar event (see Timers in The GNU Shepherd Manual).

Anonip Service

Anonip is a privacy filter that removes IP address from web server logs. This service creates a FIFO and filters any written lines with anonip before writing the filtered log to a target file.

The following example sets up the FIFO /var/run/anonip/https.access.log and writes the filtered log file /var/log/anonip/https.access.log.

(service anonip-service-type
         (anonip-configuration
           (input  "/var/run/anonip/https.access.log")
           (output "/var/log/anonip/https.access.log")))

Configure your web server to write its logs to the FIFO at /var/run/anonip/https.access.log and collect the anonymized log file at /var/web-logs/https.access.log.

Data Type: anonip-configuration

This data type represents the configuration of anonip. It has the following parameters:

anonip (default: anonip): The anonip package to use.
input: The file name of the input log file to process. The service creates a FIFO of this name. The web server should write its logs to this FIFO.
output: The file name of the processed log file.

The following optional settings may be provided:

debug?: Print debug messages when #true.
skip-private?: When #true do not mask addresses in private ranges.
column: A 1-based indexed column number. Assume IP address is in the specified column (default is 1).
replacement: Replacement string in case address parsing fails, e.g. "0.0.0.0".
ipv4mask: Number of bits to mask in IPv4 addresses.
ipv6mask: Number of bits to mask in IPv6 addresses.
increment: Increment the IP address by the given number. By default this is zero.
delimiter: Log delimiter string.
regex: Regular expression for detecting IP addresses. Use this instead of column.