Squid log rotation with newsyslog

Getting squid logs rotated in a competent fashion seems to be poorly documented and took me several attempts to get right without ending up with random 0 byte log files.

Here’s my recipe to get your squid log files rotated once per day, holding seven day’s history (as well as today’s in-progress log).

These are written for newsyslog(8) on FreeBSD. If you’re using logrotate then you’ll have to write your own configuration, but the squid.conf changes will still apply to you (probably).

Here’s what to put in your /etc/newsyslog.conf.

/usr/local/squid/logs/access.log squid:squid    644     7       *       @T00     ZB      /var/run/squid/squid.pid        30
/usr/local/squid/logs/cache.log squid:squid     644     7       *       @T00     ZB      /var/run/squid/squid.pid        30
/usr/local/squid/logs/store.log squid:squid     644     7       *       @T00     ZB      /var/run/squid/squid.pid        30

You must check that your squid.pid is in /var/run/squid - if it’s not then change the path on each line. It may be in /usr/local/squid. (Or change the pid_filename option in squid.conf.)

If you want more than seven day’s history, change the “7″.

ZB compresses the logs with gzip and prevents newsyslog from writing the “log rotated” header in the new file. Finally, the 30 is the signal (USR1) we need to send squid to make it reopen the logfiles.

Now open up your squid.conf and set logfile_rotate to 0.

That’s it. You can check what newsyslog will do (without actually doing it) with newsyslog -nvF.

# ls -l /usr/local/squid/logs/
total 37220
-rw-r--r--  1 squid  squid   9966165 Dec  7 14:43 access.log
-rw-r--r--  1 squid  squid   2218363 Dec  6 23:57 access.log.0.gz
-rw-r--r--  1 squid  squid   1592815 Dec  5 23:59 access.log.1.gz
-rw-r--r--  1 squid  squid   2062851 Dec  4 23:59 access.log.2.gz
-rw-r--r--  1 squid  squid   1764973 Dec  3 23:59 access.log.3.gz
...