Rolled log filename format
Content Gateway provides a consistent name format for rolled log files that allows you to identify log files.
When Content Gateway rolls a log file, it saves and closes the old file and starts a new file. Content Gateway renames the old file to include the following information:
- The format of the file (for example, squid.log).
- The hostname of the Content Gateway server that generated the log file.
- Two timestamps separated by a hyphen (-). The first time stamp is a lower bound for the time stamp of the first record in the log file. The lower bound is the time when the new buffer
for log records is created. Under low load, the first time stamp in the filename can be different from the timestamp of the first entry. Under normal load, the first time stamp in the filename and
the time stamp of the first entry are similar.
The second time stamp is an upper bound for the time stamp of the last record in the log file (this is normally the rolling time).
- The suffix .old, which makes it easy for automated scripts to find rolled log files.
The timestamps have the following format:
%Y%M%D.%Hh%Mm%Ss-%Y%M%D.%Hh%Mm%Ss
The following table describes the format:
| Code | Definition | Example |
|---|---|---|
| %Y | The year in four-digit format | 2000 |
| %M | The month in two-digit format, from 01-12 | 07 |
| %D | The day in two-digit format, from 01-31 | 19 |
| %H | The hour in two-digit format, from 00-23 | 21 |
| %M | The minute in two-digit format, from 00-59 | 52 |
| %S | The second in two-digit format, from 00-59 | 36 |
The following is an example of a rolled log filename:
squid.log.mymachine.20000912.12h00m00s- 20000913.12h00m00s.old
In this example, the file is squid log format and the host machine is mymachine. The first time stamp indicates a date and time of year 2000, month September, and day 12 at 12:00 noon. The second time stamp indicates a date and time of year 2000, month September, and day 13 at 12:00 noon. At the end, the file has a .old suffix.
The logging system buffers log records before writing them to disk. When a log file is rolled, the log buffer might be partially full. If so, the first entry in the new log file will have a time stamp earlier than the time of rolling. When the new log file is rolled, its first time stamp will be a lower bound for the time stamp of the first entry. For example, suppose logs are rolled every three hours, and the first rolled log file is:
squid.log.mymachine.19980912.12h00m00s- 19980912.03h00m00s.old
If the lower bound for the first entry in the log buffer at 3:00:00 is 2:59:47, the next log file, when rolled, will have the following time stamp:
squid.log.mymachine.19980912.02h59m47s- 19980912.06h00m00s.old
The contents of a log file are always between the two timestamps. Log files do not contain overlapping entries, even if successive timestamps appear to overlap.