Tutorial: Set Up a Log File Rotation
Overview
This tutorial sets an allowable log file size and automates the deletion of old log files.
By default, Access Server archives a log file when it reaches about one megabyte. The number of log files grows endlessly until the disk is full. You can follow these steps to set up a log rotation.
An installed Access Server.
Access to your server's console and the ability to get root privileges.
To adjust the log file size before it's archived, change the setting in as.conf with the LOG_ROTATE_LENGTH parameter:
Sign on to the console and get root privileges.
Open as.conf for editing in a text editor (such as nano):
nano /usr/local/openvpn_as/etc/as.confAdd the following line at the bottom (the number represents bytes, and the default is around 1000000 bytes, about 1 megabyte):
LOG_ROTATE_LENGTH=1000000Save and exit by pressing Ctrl+x, then y.
Restart the Access Server service:
systemctl restart openvpnasAccess Server writes to the current log file until it reaches your new, specified file size.
You can set up a cron job that periodically deletes old log files.
The number of files you choose to retain, times the file size of the log ration setting, determines how much log data you keep in total, ensuring you never exceed a certain number of bytes used for Access Server's log files.
Example cron job
Here's an example cron job for deleting old log files. Adjust the commands for your limits and execution time.
To set up a cron job that clears log files number .15 and higher at 4:00 a.m. each night:
Sign in to the console and get root privileges.
Open the crontab file for the account you are signed in as:
crontab -eSelect an editor when prompted when doing this for the first time.
At the bottom of the crontab file, add these two lines:
SHELL=/bin/bash 0 4 * * * /bin/rm /var/log/openvpnas.log.{15..1000} >/dev/null 2>&1Save and exit by pressing Ctrl+x, then y (if you use nano as your editor).
The script deletes files named /var/log/openvpnas.log.15 and greater every night. Your system keeps the main log file and 14 archived log files.
By default, Docker captures the standard output (and standard error) of all your containers and writes them in files using the JSON format.
When you install Access Server in a Docker container, the Access Server logs are stored in this JSON log file under the Linux host.
This JSON log file is generally stored at:
/var/lib/docker/containers/[container-id]/[container-id]-json.log
In addition, there are two ways to store Docker logs:
Docker daemon logs: These logs are generated by the Docker daemon and located on the host. It provides insights into the state of the Docker platform.
Docker container logs: These logs capture the output from applications running inside containers.
Suppose you want to configure log rotation for the Access Server logs. You can do this by using the log driver and setting it in either Docker daemons logs or Docker container logs. This is explained in detail below.
Option 1: Configuring log driver via Docker daemon logs
Locate or create the
daemon.jsonfile:On Linux hosts, the
daemon.jsonfile is located at/etc/docker.If the file doesn't exist, create it:
nano /etc/docker/daemon.json
Add the following configuration:
{ "log-driver": "json-file", "log-opts": { "max-size": "1m", "max-file": "3" } }max-size: Limits the size of each Docker log file (e.g.,1m= 1MB).max-file: Specifies the maximum number of log files to retain (e.g.,3).
Restart Docker for the changes to take effect:
systemctl restart dockerVerify the configuration for the log rotation:
docker inspect --format '{{ json .HostConfig.LogConfig }}' openvpn-asExpected output:
root@Docker:~# docker inspect --format '{{ json .HostConfig.LogConfig }}' openvpn-as {"Type":"json-file","Config":{"max-file":"3","max-size":"1m"}}
Option 2: Configuring log driver via Docker container logs
Use the
docker runcommand to set the appropriate values for thelog-driverandlog-optkeys when creating the Access Server Docker container or updating an existing container:If you're creating the Docker container the first time, run these commands:
docker run -d \ --name=openvpn-as --device /dev/net/tun \ --cap-add=MKNOD --cap-add=NET_ADMIN \ -p 943:943 -p 443:443 -p 1194:1194/udp \ -v <path to data>:/openvpn \ --log-driver json-file \ --log-opt max-size=1m \ --log-opt max-file=3 \ --restart=unless-stopped \ openvpn/openvpn-asReplace
<path to data>with the directory for configuration files.
If you've already created the Access Server in Docker CE, you can remove the container and rerun the
docker runcommands:Stop the existing container:
docker stop openvpn-asRemove the container:
docker rm openvpn-asRecreate the container with logging options:
docker run -d \ --name=openvpn-as --device /dev/net/tun \ --cap-add=MKNOD --cap-add=NET_ADMIN \ -p 943:943 -p 443:443 -p 1194:1194/udp \ -v <path to data>:/openvpn \ --log-driver json-file \ --log-opt max-size=1m \ --log-opt max-file=3 \ --restart=unless-stopped \ openvpn/openvpn-asReplace
<path to data>with the directory for configuration files.
Verify the configuration for the log rotation:
docker inspect --format '{{ json .HostConfig.LogConfig }}' openvpn-asExpected output:
root@Docker:~# docker inspect --format '{{ json .HostConfig.LogConfig }}' openvpn-as {"Type":"json-file","Config":{"max-file":"3","max-size":"1m"}}