Equivalent of logrotate on OSX

Is logrotate hiding somewhere on OSX, or is there an equivalent? It's not in /usr/sbin.

Solution 1:

Based on Brian Armstrong's answer, here's something with a little more explanation and a correction. This handles the log created by postgres on OSX installed by Homebrew. Located at /etc/newsyslog.d/postgresql.conf:

# logfilename                           [owner:group]      mode count size(KB)  when  flags [/pid_file]                            [sig_num]
/usr/local/var/postgres/postgresql.log  :                  600  2     2048      *     J     /usr/local/var/postgres/postmaster.pid

This will rotate the log file when it reaches 2MB in size, keep 2 archives (for a total of 6MB storage used), and bzip2-compress the archives. It will notify the postgres process to reopen the log files once rotated, which is necessary to get new log entries and to actually free the disk space without restarting the machine.

Important to note that size is in KB, not bytes.

You can test the config file (without affecting any files) using sudo newsyslog -nvv.

newsyslog documentation is located here: http://www.freebsd.org/cgi/man.cgi?newsyslog.conf(5). Also used: http://www.redelijkheid.com/blog/2011/3/28/adding-custom-logfile-to-os-x-server-log-rotation.html

Solution 2:

OS X has several ways to rotate/expire/etc its logs, depending on the type of log in question:

For regular log files (i.e. text files that are continuously appended to), newsyslog can rotate them based on size or time, although it doesn't seem to have as many options as logrotate. It's configured by /etc/newsyslog.conf and /etc/newsyslog.d/* (generally, you should add files to /etc/newsyslog.d/ to add logs to its management list).
OS X's syslog system is migrating from this plain-text format to database format, mainly in /var/log/asl/. I don't entirely understand this system yet, but this database seems to be purged by aslmanager, which is configured by /etc/asl.conf.
For directories that have individual log "entries" added as separate files (mainly /Library/Logs/CrashReporter/), the files get purged by /etc/periodic/daily/100.clean-logs. Its policies (which directories to scan & how long to leave files) are configured in /etc/defaults/periodic.conf, but if you want to override/change them you should create /etc/periodic.conf.local and put your customizations there.

If what you want to rotate doesn't fit any of these models, you can add your own scripts to /etc/periodic/daily/ (which'll be run every morning at 3:15am), /etc/periodic/weekly/ (every saturday morning at 3:15am), or /etc/periodic/monthly/ (first of every month at 5:30am).

Solution 3:

You can get logrotate via Homebrew. Here are my notes from setting this up.

Install

brew install logrotate

Configure log rotation

Log rotation config files are in /usr/local/etc/logrotate.d/

Edit config file. E.g. I wanted to rotate some "/var/log/tend_*.log" files I introduced:

sudo vi /usr/local/etc/logrotate.d/tend.conf

Contents: /var/log/tend_*.log { daily copytruncate rotate 3 size 10M compress }

Test it out

sudo logrotate -v -f /usr/local/etc/logrotate.d

Start service

sudo brew services start logrotate

Restart service

sudo brew services restart logrotate

Solution 4:

newsyslog runs automatically on OSX, I use a config file like this in /etc/newsyslog.d/rails_apps.conf to keep my dev log files trimmed to 5MB

# logfilename                           [owner:group]   mode count size     when  flags [/pid_file] [sig_num]
/Users/barmstrong/code/**/log/*.log                     666  0     5242880  *     G