How to reduce logs size

Question

In every project I've been working on there's always been the issue of log files becoming too large. A quick off the shelf solution was to use the Log4j RollingFileAppender and set the maximum size allowed. However there are situations when the same exception happens repeatedly reaching the maximum size very quickly, before somebody manually intervenes. In that scenario because of the rolling policy you end up losing information of important events that happened just before the exception. Can anybody suggest a fix for this issue?

P.S. Something I can think of is to hold a cache of the Exceptions happened so far, so that when the same Exception re-occurs I don't log tons of stacktrace lines. Still I think this must be a well-known issue and I don't want to reinvent the wheel.

Answer 1

Buy bigger hard drives and set up a batch process to automatically zip up older logs on a regular basis.

(Zip will detect the repeated exception pattern and compress it very effectively).

Answer 2

Use Log4J feature to zip the log file after a specified size is reached using "Rolling File Appender". Zips are around 85KB for a 1MB file. For this specify the trigger policy to zip based on size and specify the zip file in the rolling policy.
Let me know if you need for info.

Answer 3

use the strategy if reach maximum size, append to the new log file. and run scheduler like everyday to wipe the old log file

Answer 4

There are two directions to approach this from: The System side and the development side. There are several answers already around dealing with this from the system side (i.e. after the application is deployed and running). However, I'd like to address the development side.

A very common pattern I see is to log exceptions at every level. I see UI components, EJB's, connectors, threads, helper classes, pojos, etc, etc, logging any and all exceptions that occur. In many cases, without bothering to check for the log level. This has the exact result you are encountering as well as making debugging and troubleshooting take more time than necessary as one has to sift through all of the duplication of errors.

My advice is to do the following in the code:

• THINK. Not every exception is fatal, and in many cases actually irrelevant (e.g. IOException from a close() operation on a stream.) I don't want to say, "Don't log an exception," because you certainly don't want to miss any issues, so at worst, put the log statement within a conditional check for the debug level

  if(logger.isDebugEnabled()){
 // log exception
}

• Log only at the top level. I'm sure this will meet with some negativity, but my feeling is that unless the class is a top-level interface into an application or component, or the exception ceases to be passed up, then the exception should not be logged. Said another way, if an exception is rethrown, wrapped and thrown or declared to be thrown from the method, do not log it at that level.

For example, the first case is contributing to the issue of too many log statements because it's likely the caller and whatever was called will also log the exception or something statement about the error.

public void something() throws IllegalStateException{
      try{
         // stuff that throws some exception
      }catch(SomeException e){
         logger.error(e); // <- NO because we're throwing one
         throw new IllegalStateException("Can't do stuff.",e);
      }
 }

Since we are throwing it, don't log it.

 public void something() throws IllegalStateException{
      try{
         // stuff that throws some exception
      }catch(SomeException e){
         // Whoever called Something should make the decision to log
         throw new IllegalStateException("Can't do stuff.",e);
      }
 }

However, if something halts the propagation of the exception, it should log it.

 public void something(){
      try{
         // stuff that throws some exception
      }catch(SomeException e){
         if(logger.isLogLevelEnabled(Log.INFO)){
            logger.error(e);                      // DEFINITELY LOG! 
         }
      }
 }

Answer 5

In my experience, logging is used as a substitute for proper testing and debugging of code. Programmers say to themselves, "I can't be sure this code works, so I'll sprinkle logging messages in it, so when it fails I can use the log messages to figure out what went wrong."

Instead of just sprinkling logging messages around without thought, consider each log message as part of the user interface of your software. The user interface for the DBA, webmaster or system administrator, but part of the user interface nonetheless. Every message should do something useful. The message should be a spur for action, or provide information that they can use. If a message could not be useful, do not log it.

Give an appropriate logging level for each message. If the message is not describing an actual problem, and is not providing status information that is often useful, the message is probably useful only for debugging, so mark it as being a DEBUG or TRACING message. Your usual Log4J configuration should not write those messages at all. Change the configuration to write them only when you are debugging a problem.

You mention that the messages are due to an exception that happens often. Not all exceptions indicate a bug in the program, or even a problem in the operation of the program. You should log all exceptions that indicate a bug in your program, and log the stack trace for them. In many cases that is almost all you need to work out the cause of the bug. If the exception you are worried about is due to a bug, you are focusing on the wrong problem: you should fix the bug. If an exception does not indicate a bug in your program, you should not log a stacktrace for it. A stacktrace is useful only to programmers trying to debug a problem. If the exception does not indicate a problem at all, you need not log it at all.