By default, the OAG appliance keeps logs for the last 30 days in gzip format. This article provides steps to change the number of days logs must be retained.

Admins can use the following criteria to check if the log retention value needs to be changed:

• Is the disk space usage high because of logs location? 
• Are there any applications with debug settings enabled that are contributing to the large number of logs? Is the global verbosity set to debug when checked from Admin UI? 

A calculation can be done on the archive logs directory to predict the results after changing the log retention value. The following command can be extended to calculate the size of individual log files under the same location:
du -sh /opt/oag/logs/archive

• After analyzing the above, a decision can be made on whether a change to the retention value is required.

NOTE:

• It is recommended to have log forwarders configured and use minimal logging on OAG to avoid using too much disk space.
• Admins can also monitor disk space using SNMP and the admin UI to see if they really need to change log retention value. 
• Any changes in the log retention value will not persist after an upgrade.

• Okta Access Gateway (OAG)
• Okta Classic Engine

Steps To Modify

1. Connect to the server and gain local shell access.
2. Execute the following command to open the config file for log rotation.
   sudo vi /opt/oag/scripts/archiveLogs.sh.
3. Type i to insert the needed value into the config file.
4. Replace every 30 (days) with the number of days required.
5. Adding a comment to document the reason for the change in value is recommended. Comments have to start with "#".
6. Type:w to save the modified file and:q to exit.

Example:

Before the change,  the script will have the following content:

# Delete files older than 30 days
find $ARCHIVE_DIR -type f -mtime +30 -delete
if [ $? -eq 0 ]; then
    $LOG "Deleted logs older than 30 days"
else
    $LOG "No old log found to be deleted"
fi

After the change:

# Delete files older than 7 days
# Changed to 7 days on <date> because of space issue
find $ARCHIVE_DIR -type f -mtime +7 -delete
if [ $? -eq 0 ]; then
    $LOG "Deleted logs older than 7 days"
else
    $LOG "No old log found to be deleted"
fi