flexible web log rotation

support cronolog development

cronolog FAQ

The questions here are compiled from a review of the emails regarding cronolog that I have received over the years. If you have a question that you think should be included here please email me.

Andrew Ford, 11 November 2002

What is cronolog?

cronolog is a simple program that reads log messages from its input and writes them to a set of output files, the names of which are constructed using a template and the current date and time. cronolog is intended to be used in conjunction with a Web server, such as Apache, to split the access log into separate log files by day, month or other specified period.

The template uses the same format specifiers as the Unix date command (which are the same as the standard C strftime library function). Each character in the template represents a character in the expanded filename, except for date and time format specifiers, which are replaced by their expansion. Format specifiers consist of a `%' followed by one of the following characters listed in the usage page.

Take for example the following Apache configuration directives:

CustomLog "|/usr/sbin/cronolog /web/logs/%Y/%m/%d/access.log"
ErrorLog  "|/usr/sbin/cronolog /web/logs/%Y/%m/%d/errors.log"

These would instruct Apache to pipe its access and error log messages into separate copies of cronolog, which would create new log files each day in a directory hierarchy structured by date, i.e. on 31 December 1996 messages would be written to


after midnight it would use the files


The directories 1997, 1997/01 and 1997/01/01 would be created if they did not already exist.

How should I organize my log files?

That is really up to you, however I like to include the year (four digits) and month (as a decimal number) in the filenames and store the files in separate directories by year. The filename templates I use are:

/web/xxx/logs/%Y/%Y-%m-xxx-access.log /web/xxx/logs/%Y/%Y-%m-xxx-errors.log

where xxx is an abbreviation for the name of the web site.

With this scheme there will be a maximum of 24 files in each bottom-level directory, and the filenames are self-explanatory and can also be sorted chronologically.

How do I generate the name of yesterday's log file

Use the GNU date command. It can format arbitrary dates and can interprete dates specified as "yesterday" or "2 days ago", or even "12:00 3 weeks 1 day ago" for if you rotate logs hourly. It takes the same date and time specifiers as cronolog, so if you want to find out the name of yesterday's log file you could specify something like:

date --date "yesterday" +"%Y-%m-%d-access.log"

Could cronolog be extended to compress or delete old log files?

There are problems with doing such things from cronolog. You might have multiple cronolog processes writing to the same file and it is a matter of chance which process gets to compress or delete the files. It is better to run periodic programs from cron (on Unix and Unix-like systems).

See the previous answer for how to generate filenames from templates for specific dates.

Is cronolog available as an Apache module?

A beta version of the module is written, but it has not received much testing. (further details)

Does cronolog run on Windows?

Yes. Klaus Mueller kindly provided Win32 binaries for cronolog version 1.6.1.

Why do I have problems compiling cronolog on BSD Unix?

Compiling cronolog on BSD systems gives the following compilation error or something very similar:

gcc -DPACKAGE=\"cronolog\" -DVERSION=\"1.6.1\" -DSTDC_HEADERS=1
DHAVE_STRPTIME=1 -DHAVE_LOCALTIME_R=1  -I. -I. -I../lib  -g -O2 -c
cronoutils.c:74: `timezone' redeclared as different kind of symbol
/usr/include/time.h:144: previous declaration of `timezone'
*** Error code 1

The offending line looks like:

extern long int timezone;

The solution is to delete or comment out this line from cronoutils.c. I have removed it in cronolog 1.6.2 as it doesn't seem to be needed any more even on Linux.

Copyright 1996-2003 Ford & Mason Ltd