How to set squid proxy logs retention period ?

Solution Verified - Updated -

Environment

  • Red Hat Enterprise Linux (All Versions)

Issue

  • We have a Squid proxy server in our environment, we want log retention in our Squid proxy server as 3 months of active logs and 6 months of archive logs.
  • How are squid proxy logs rotated by default ?

Resolution

  • You can rotate the current logs and compress them on the system, which will include the active and archived logs. Every week active logs will be archived.

  • To keep archived logs worth of 6 months, you can set rotate parameter as below :

   # vi /etc/logrotate.d/squid 
   /var/log/squid/*.log {
       weekly
       rotate 24              ## Weekly rotation, for 6 months (4 weeks x 6 months = 24 weeks)
       compress
       notifempty
       missingok
       nocreate
       sharedscripts
       postrotate
            /usr/sbin/squid -k rotate 2>/dev/null
       endscript
   }

Root Cause

  • With default parameters the rotation is done weekly basis and 5 weeks worth of logs are maintained or kept on the system.
   # cat /etc/logrotate.d/squid 
   /var/log/squid/*.log {
       weekly
       rotate 5             
       compress
       notifempty
       missingok
       nocreate
       sharedscripts
       postrotate
            /usr/sbin/squid -k rotate 2>/dev/null
       endscript
   }

Diagnostic Steps

  • Check which package provides the rotation script.

      # rpm -qf /etc/logrotate.d/squid

  • Check default configuration parameters for logrotate of squid.

      # cat /etc/logrotate.d/squid

This solution is part of Red Hat’s fast-track publication program, providing a huge library of solutions that Red Hat engineers have created while supporting our customers. To give you the knowledge you need the instant it becomes available, these articles may be presented in a raw and unedited form.

Comments