The current log configuration for the Virtual Appliance “rotates” the log file at 512mb, but does not save the previous file to allow for debugging. This is an issue if you are trying to debug an issue that occurred around the time that the log rotate. Rotate is in quotes here, because it is actually just truncating the data when the size reaches 512mb, even though the option to rotate the files is mostly configured.
Current logrotate configuration looks like this:
/home/sailpoint/log/*.log
{
daily
size 512M
rotate 0
create 644 root root
missingok
compress
notifempty
nodateext
copytruncate
prerotate
/bin/truncate -s 0 /home/sailpoint/log/ccg.log
/bin/truncate -s 0 /home/sailpoint/log/identityiq*.log
endscript
}
Here is a topic from last year on this point as well: Archival of Virtual Appliance Logs - #3
Do note that the Accepted Solution here is no longer valid per SailPoint Support, and the KB that was referenced in the sultion has since been updated to remove the archive/compress wording. Support stated that the log rotating at 512mb with no archive is the intended functionality currently.
It would be great if the log files (when not in debug mode) could be rotated and at least 1 previous version compressed/saved so that administrators could download the previous files in case of an incident that spans the rotation point, or for maintaining internal archival processes.