Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

logrotate working but ignoring size

Tags:

logrotate

  • CentOS v.7
  • Logrotate v.3.8.6

I set logrotate to rotate when file reaches 5M but it ignores it, if I add daily it will rotate daily regardless of size, i tried with size, minsize and maxsize all the same the only difference is with "size" it doesnt even refer to it in the output, here is my config and output of logrotate -vdf /etc/logrotate.d/maillog

(the actual log file size when running the following tests was 45K)

(the conf file is the same for all tests only the size parameter changed)

/var/log/maillog {
    size 5M
    rotate 50
    create 644 root root
    dateext
    dateformat -%Y-%m-%d_%H_%s
    notifempty
    postrotate  systemctl restart rsyslog
        systemctl restart postfix
    endscript }

SIZE:

logrotate -vdf /etc/logrotate.d/maillog

reading config file /etc/logrotate.d/maillog
Allocating hash table for state file, size 15360 B

Handling 1 logs

rotating pattern: /var/log/maillog  forced from command line (50 rotations)
empty log files are not rotated, old logs are removed
considering log /var/log/maillog
  log needs rotating
rotating log /var/log/maillog, log->rotateCount is 50
Converted ' -%Y-%m-%d_%H_%s' -> '-%Y-%m-%d_%H_%s'
dateext suffix '-2017-12-19_13_1513689486'
glob pattern '-[0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9]_[0-9][0-9]_[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]'
fscreate context set to unconfined_u:object_r:var_log_t:s0
renaming /var/log/maillog to /var/log/maillog-2017-12-19_13_1513689486
creating new /var/log/maillog mode = 0644 uid = 0 gid = 0
running postrotate script
running script with arg /var/log/maillog: "
    systemctl restart rsyslog
    systemctl restart postfix
"

No reason for "log needs rotating" is given.

MINSIZE:

logrotate -vdf /etc/logrotate.d/maillog

reading config file /etc/logrotate.d/maillog
Allocating hash table for state file, size 15360 B

Handling 1 logs

rotating pattern: /var/log/maillog  forced from command line (50 rotations)
empty log files are not rotated, only log files >= 5242880 bytes are rotated, old logs are removed
considering log /var/log/maillog
  log needs rotating
rotating log /var/log/maillog, log->rotateCount is 50
Converted ' -%Y-%m-%d_%H_%s' -> '-%Y-%m-%d_%H_%s'
dateext suffix '-2017-12-19_13_1513689869'
glob pattern '-[0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9]_[0-9][0-9]_[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]'
fscreate context set to unconfined_u:object_r:var_log_t:s0
renaming /var/log/maillog to /var/log/maillog-2017-12-19_13_1513689869
creating new /var/log/maillog mode = 0644 uid = 0 gid = 0
running postrotate script
running script with arg /var/log/maillog: "
    systemctl restart rsyslog
    systemctl restart postfix
"

Here it shows, "only log files >= are rotated" but no reason for "log needs rotating" is given.

MAXSIZE:

reading config file /etc/logrotate.d/maillog
Allocating hash table for state file, size 15360 B

Handling 1 logs

rotating pattern: /var/log/maillog  forced from command line (50 rotations)
empty log files are not rotated, log files >= 5242880 are rotated earlier, old logs are removed
considering log /var/log/maillog
  log needs rotating
rotating log /var/log/maillog, log->rotateCount is 50
Converted ' -%Y-%m-%d_%H_%s' -> '-%Y-%m-%d_%H_%s'
dateext suffix '-2017-12-19_13_1513690859'
glob pattern '-[0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9]_[0-9][0-9]_[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]'
fscreate context set to unconfined_u:object_r:var_log_t:s0
renaming /var/log/maillog to /var/log/maillog-2017-12-19_13_1513690859
creating new /var/log/maillog mode = 0644 uid = 0 gid = 0
running postrotate script
running script with arg /var/log/maillog: "
    systemctl restart rsyslog
    systemctl restart postfix
"

Here it shows, "log files => are rotated" but no reason for "log needs rotating" is given.

Why is it ignoring file size when rotating?

like image 518
Sruli Avatar asked Dec 19 '17 13:12

Sruli


People also ask

How often does logrotate check size?

Then have a cron to run every, say 5 minutes (giving space for possible anomalies) to check the size. Therefore every 5 minutes logrotate will run and if the size is greater than 5M it will rotate the logs.

How do I know if logrotate is working?

To verify if a particular log is indeed rotating or not and to check the last date and time of its rotation, check the /var/lib/logrotate/status file. This is a neatly formatted file that contains the log file name and the date on which it was last rotated. You'll find this file as /var/lib/logrotate.

What is size in logrotate?

The size is a value in the range of 10- 200 MB, and it cannot exceed 32 MB for transferred files. Usage. A log file that exceeds either the configured <MAX-SIZE> value or the logrotate period , triggers rotation for that log file.

What is Delaycompress in logrotate?

When delaycompress is active, an archived log is compressed the next time that the log is rotated. This can be important when you have a program that might still write to its old log file for a time after a fresh one is rotated in. Note that delaycompress works only if you have compress in your configuration.


1 Answers

You're running logrotate with -f, in that scenario it's always going to force a rotation with a complete lack of regard for your other options:

https://manpages.debian.org/jessie/logrotate/logrotate.8.en.html

-f, --force Tells logrotate to force the rotation, even if it doesn't think this is necessary.

It gives you no reason because you in fact were the reason-giver.

like image 172
parttimeturtle Avatar answered Oct 12 '22 13:10

parttimeturtle