Zabbix Server/Agent Log-Rotation

[abi]

hi,

we (the debian maintainers for zabbix) have received a
bugreport by a user which is somehow related to how
zabbix-server and zabbix-agent[d] handle logfiles. Most
distributions provide some kind of logrotate facility,
so does Debian.

This means logrotate takes care of rotating logfiles for
the different Services (like apache etc.) (with renaming,
gzipping, restarting the service after rotation and so
on ..)

Now, zabbix-server renames its logfiles to .old if the
logfile size is greater than 1024*1024 (and overwrites
this file then). This leads to one problem: If a user
wants to debug his Server over a few days with a high
debug level, some logging information may be lost due to
the .old files getting overwritten.

So, this leads to one question: should zabbix, if caring
about rotating its logfiles, rotate them in some kind of
safe way (like, zabbix-server.log.1 zabbix-server.log.2)
and take care about compressing them (like logrotate does)
or simply should not care about this task and leave it up
to the distributors (by using logrotate) to care about
log-rotation (i dont know how *BSD or other *nixes like
Solaris handle this).

[Alexei]

I have seen the thread in a Debian mailing list. What about an additional parameter which would disable ZABBIX log rotation?

[abi]

I have seen the thread in a Debian mailing list. What about an additional parameter which would disable ZABBIX log rotation?

i have thought about this too, would be great!

[schneck]

max size and/or rotation

I have seen the thread in a Debian mailing list. What about an additional parameter which would disable ZABBIX log rotation?

What about this:

Define a parameter for the maximum size of the log file, after which it will be rotated (instead of the hardcoded 1MB limit).
If this parameter == 0, assume somebody else will take care of rotating the log file.

Currently, I believe Zabbix does open/write/close for every log message, so external log rotation would bring no problems.

If (at some time in the future) it will be decided to keep the log file open all the time (and fflush(3)ing at the right moments) for improved perfomance, some means to close/reopen the logfile would be needed (conventionally SIGHUP handler)

\ B.

[Alexei]

Would it be a problem for Debian and other distributions if this parameter will be configured via WEB front-end and thus stored in ZABBIX database, not in the configuration file?

[abi]

Would it be a problem for Debian and other distributions if this parameter will be configured via WEB front-end and thus stored in ZABBIX database, not in the configuration file?

well, we would set the parameter in the configuration
file to disable zabbix internal log-rotation for the default
installation and leave this task to logrotate. When setting
this option through the web-interface, we would probably have
to mess around in the database or something (for the package
upgrades etc).

Its not a *big* problem, as we can manage this, but it makes
the package's maintenance sort of long winded.

[Alexei]

Thanks for the quick response.

[tbenoit]

We're hitting this problem right now. We have an issue where the Zabbix server accepting data from the agents. It takes a while (anywhere from 1 - 5 days) for this to occur. We have been running the server in Max debug mode, but the log file is rotated every couple of minutes because it is about 1MB in size. We can't hope to catch the issue with the log rotating like this.

I looked around the config file and the Zabbix web interface and didn't see where this was configurable.

Thoughts?

[Alexei]

Debian logrotation scripts must not restart ZABBIX daemons. ZABBIX creates log file automatically if one does not exists!

[tbenoit]

Debian logrotation scripts must not restart ZABBIX daemons. ZABBIX creates log file automatically if one does not exists!

Understood, but this isn't just a Debian issue, nor an OS log rotation issue( we're actually running RHEL4). It's a Zabbix Server issue in how the log file is rotated. With debug on, it's rotated every minute or two. We can't hope to catch the error when it occurs with the log rotating like that.

Any way to force Zabbix to not rotate it, or rotate it less often and save "X" number of versions of the rotated log file?

[pierre-hoffmann]

Hi,

I'm very intereseting to set my own maximum logfile (1 Mo is too small !)
size and name ..

Is this allready implemented in some version of Zabbix ??

Regards,

[Alexei]

Yes, max size is already implemented. Look at the Manual!

[pierre-hoffmann]

Hi,

i've not see it , sorry:

[Added in version 1.4]
2.1.18.7. More flexible log rotation
New parameter, LogFileSize, controls parameters of log rotation for ZABBIX server and agents.

LogFileSize
This parameter controls log rotation setting for LogFile.
By default, ZABBIX automatically roatates log file when it reaches 1MB.
This parameter is in MB.
If set to 0, no log rotation will be performed.

Regards,
Pierre.

[RomainZabbix]

Understood, but this isn't just a Debian issue, nor an OS log rotation issue( we're actually running RHEL4). It's a Zabbix Server issue in how the log file is rotated. With debug on, it's rotated every minute or two. We can't hope to catch the error when it occurs with the log rotating like that.

Any way to force Zabbix to not rotate it, or rotate it less often and save "X" number of versions of the rotated log file?

Hello, I know it's been 15 years now but I have the same problem. Does anybody have a solution ?

[markfree]

Hello, I know it's been 15 years now but I have the same problem. Does anybody have a solution ?

Your issue is not clear, but check out Zabbix Server log options in configuration file.