LinuxQuestions.org - confused about use of logrotate and cron.daily

- Linux - Newbie (https://www.linuxquestions.org/questions/linux-newbie-8/)

- - confused about use of logrotate and cron.daily (https://www.linuxquestions.org/questions/linux-newbie-8/confused-about-use-of-logrotate-and-cron-daily-4175416620/)

confused about use of logrotate and cron.daily

Hi,

Recently I saw that my syslog and daemon.log files in /var/log directory are huge (7G each). They were eating up all the diskspace in my / directory. So to save some space I truncated the daemon.log using the truncate command and restarted the laptop. There were a lot of errors while shutting down but eventually things became normal.

So far so good.

Now I was looking about limiting size of logfiles. And found that I can use logrotate as a cron job to do so (http://www.thegeekstuff.com/2010/07/logrotate-examples/) As per the guide, I poked around in my configurations. Here is how things look:

Code:

somesh@creativision:/etc/logrotate.d$ crontab -l

no crontab for somesh

Code:

somesh@creativision:/etc/logrotate.d$ cd /etc/cron.daily/

somesh@creativision:/etc/cron.daily$ ll

total 76

-rwxr-xr-x 1 root root  311 Mar  9  2008 0anacron

-rwxr-xr-x 1 root root 14799 Apr 15  2011 apt

-rwxr-xr-x 1 root root  314 Dec  4  2008 aptitude

-rwxr-xr-x 1 root root  502 Nov 20  2007 bsdmainutils

-rwxr-xr-x 1 root root  256 Apr 26  2011 dpkg

-rwxr-xr-x 1 root root  4109 May 12  2011 exim4-base

-rwxr-xr-x 1 root root  7623 Jul  9 21:29 google-chrome

lrwxrwxrwx 1 root root    45 Jun 26 08:31 google-talkplugin -> /opt/google/talkplugin/cron/google-talkplugin

-rwxr-xr-x 1 root root  580 Sep 23  2008 htdig

-rwxr-xr-x 1 root root    89 Oct  8  2008 logrotate

-rwxr-xr-x 1 root root  1335 Jan  2  2011 man-db

-rwxr-xr-x 1 root root  606 Nov  4  2009 mlocate

-rwxr-xr-x 1 root root  1154 Nov 22  2009 ntp

-rwxr-xr-x 1 root root  249 Feb 15  2011 passwd

-rwxr-xr-x 1 root root  3594 Dec 18  2010 standard

Code:

somesh@creativision:/etc/cron.daily$ cat logrotate 

#!/bin/sh



test -x /usr/sbin/logrotate || exit 0

/usr/sbin/logrotate /etc/logrotate.conf

Code:

somesh@creativision:/etc/logrotate.d$ cat /etc/logrotate.conf 

# see "man logrotate" for details

# rotate log files weekly

weekly



# keep 4 weeks worth of backlogs

rotate 4



# create new (empty) log files after rotating old ones

create



# uncomment this if you want your log files compressed

#compress



# packages drop log rotation information into this directory

include /etc/logrotate.d



# no packages own wtmp, or btmp -- we'll rotate them here

/var/log/wtmp {

    missingok

    monthly

    create 0664 root utmp

    rotate 1

}



/var/log/btmp {

    missingok

    monthly

    create 0660 root utmp

    rotate 1

}



# system-specific logs may be configured here

Code:

somesh@creativision:/etc/logrotate.d$ ll

total 52

-rw-r--r-- 1 root root 173 Apr 15  2011 apt

-rw-r--r-- 1 root root  79 Dec  4  2008 aptitude

-rw-r--r-- 1 root root 135 Feb 24  2010 consolekit

-rw-r--r-- 1 root root 248 Mar  2  2010 cups

-rw-r--r-- 1 root root 232 Apr 26  2011 dpkg

-rw-r--r-- 1 root root 146 Sep 30  2008 exim4-base

-rw-r--r-- 1 root root 126 Sep 30  2008 exim4-paniclog

-rw-r--r-- 1 root root  94 May 16  2008 hibernate

-rw-r--r-- 1 root root 157 Nov 16  2010 pm-utils

-rw-r--r-- 1 root root  94 Aug  8  2010 ppp

-rw-r--r-- 1 root root 559 Jul 13 22:51 rsyslog

-rw-r--r-- 1 root root 222 Feb  3  2010 squid

-rw-r--r-- 1 root root 114 Oct  2  2006 unattended-upgrades

Code:

somesh@creativision:/etc/logrotate.d$ cat rsyslog

/var/log/syslog

{

        rotate 7

        daily

        missingok

        notifempty

        delaycompress

        compress

        postrotate

                invoke-rc.d rsyslog reload > /dev/null

        endscript

}



/var/log/mail.info

/var/log/mail.warn

/var/log/mail.err

/var/log/mail.log

/var/log/daemon.log

/var/log/kern.log

/var/log/auth.log

/var/log/user.log

/var/log/lpr.log

/var/log/cron.log

/var/log/debug

/var/log/messages

{

        rotate 4

        weekly

        missingok

        notifempty

        compress

        delaycompress

        sharedscripts

        postrotate

                invoke-rc.d rsyslog reload > /dev/null

        endscript

}

My questions are:
1. As far as I know, even if my list of crontab (crontab -l) shows nothing, the files under cron.daily directory work as a daily cronjob. Is that right?
2. Is the daily cron of logrotate looking into all the files in logrotate.d directory ("include /etc/logrotate.d" line in logrotate.conf) and rotating the logs accordingly? Or is it just rotating wtmp and btmp?
3. It seems to me that if I add a line "size 1000000k" in the rsyslog file in logrotate.d, the size of these log files will be limited to 1G. Now will that hamper the performance of my laptop any way?

TIA,

1. The cron.daily files will be run by root - if you type the 'crontab -l' command as super-user, you should see that a script is run daily that executes the cron.daily files.

2. logrotate uses all the files in the logrotate.d directory, as a consequence of the include line.

3. You could use "size 1000000k" instead of "daily", to rotate when the file gets too big instead of daily - this shouldn't impact the laptop performance. The real issue is why syslog isn't being rotated daily, since that is what should be happening with this configuration.

Do you turn off your laptop nightly? If so, check the output from the 'crontab -l' to see when the cron.daily files are being run. You may need to edit the crontab to get them run at a time that the laptop is on.

Quote:

Originally Posted by timufea (Post 4727758)

Thanks timufea!

The crontab list for super-user also seems to be empty

Code:

somesh@creativision:~$ sudo crontab -l

no crontab for root

somesh@creativision:~$ su

Password: 

creativision:/home/somesh# crontab -l

no crontab for root

creativision:/home/somesh#

So is the cron.daily logrotate is not running at all?

On the last note: Yes, I do turn off or put it to sleep nightly. So if the cron job is set to run late at night, it may not be able to logrotate at all. But I cannot find any time schedule for the cron.daily jobs.

TIA

You are probably running a version of cron (e.g. "Vixie Cron") that has a system-wide config file '/etc/crontab' - the times for cron.daily etc. will be there. You can, as root, simply edit this file - you don't need to use 'crontab -e'.

If you can't choose a time of day when your laptop will always be on, you could move the logrotate file from cron.daily to cron.hourly. This would run logrotate hourly, but it would still rotate files according to its configuration (daily, weekly, by size, ...).

You can also check out anacron, which runs any crons that should have run by the time anacron is started.