Structured logfile rotation

Rotating structure logfiles is a best practice to allow the analysis of recent events while also limiting the total volume of log data.

Each of the configured serverlog.file.N files has its own corresponding serverlog.maxmb.N and serverlog.retain.N configurables. For each configured server log type, these configurables control the maximum size (in megabytes) of the logfile before rotation, and the number of rotated server logs retained by the server.

Structured log files are automatically rotated on checkpoint, journal creation, overflow of associated serverlog.maxmb.N limit (if configured), and the p4 logrotate command. You can disable log rotation after journal rotation by setting the configurable dm.rotatelogwithjnl to 0. Disabling this behavior can help when you’re doing frequent journal rotations and you want the log rotated on a different schedule.

You can use the serverlog.counter.N configurable to create a counter that tracks the number of times a structured log file has been rotated. For example, the following command creates a rotation counter called myErrorsCount:

$ p4 configure set serverlog.counter.3=myErrorsCount

Each time the errors.csv log file is rotated, the counter is increased by one. In addition, the name of the log file is changed to specify the pre-incremented counter value. That is, if the counter myErrors is 7, the errors.csv file is named errors-6.csv.

You can create a counter for each file described in the preceding table. Do not use system-reserved counter names for your counter: change, maxCommitChange, job, journal, traits, upgrade.

The p4 logtail command returns the current value of the counter when you logtail that log. It also returns the current size of the log at the end of the output (along with the ending offset in the log). The size and offset are identical if p4 logtail reads to the end of the log. Security monitoring tools can use counters and the p4 logtail command in the process of scanning log files to monitor suspicious activity.