How can I extend the time when system.log gets turned over?

Question

Right now my system.log gets recreated every 24 hours or so with a message like:

Jan  4 00:30:01 Mac newsyslog[63416]: logfile turned over

Can I change a setting such that it will get rotated every month? Or every week?

Having a much longer time would allow for better visibility of the progression of some errors.

Answer 1

The system calls newsyslog to prune files every time a 30th minute arrives (or a little bit later if the machine is either extremely busy or sleeping).

You can see the man page for newsyslog and it's configuration file or just dive in and edit the configuration file /etc/newsyslog.conf

For a pruning each month at midnight, you would change the time from @T00 to $M1D0 or for weekly on sunday at 3 AM to $W0D03

You might want to make sure you have enough space on your filesystem for a month - especially if you get some noisy software. You can also prune on size for a while if you wish, since that's easier to know when you'll want a prune based on how large a file you expect.

Answer 2

You use newsyslog command. There is plenty of online documentation out there on how to do this, but here's a start:

https://serverfault.com/questions/264292/osx-var-log-system-log-where-do-i-define-pruning-interval

Answer 3

If you are simply looking for ways to establish a timeframe for a crash, then either of the following may help:

% sysctl -a | grep boottime

% last | grep crash

Answer 4

Since your ultimate goal is to trace the history of information in the system.log files, you could, as an alternative, try grep from the command line, and search all system logs at once. I'm not a pro with grep, but looking for something like "shutdown" in all logs could be done via:

grep shutdown /var/log/system.log*

This would produce a single output with any line containing the word "shutdown". The * at the end is a regular expression that expands the search to all files starting with system.log, regardless of the extension that follows (e.g., system.log.0.bz2, system.log.0.bz3). If you grok regular expressions, aka "regex" (I do not), then you can further augment this kind of search and make it ridiculously powerful and specific. You can check out this link and this link for more information about regular expressions.

Also, if you wanted to view the results outside of Terminal, you could pipe the results to a plain text file via:

grep shutdown system.log* | ~/Desktop/results.txt

I realize this doesn't restructure your system logs, but it does get you the end result you're looking for.