logrotate problem

saavik · 12-22-2008, 01:57 AM

My logrotate does not delete logs older than 1 week. I still have old logs.

Here is the logrotate.conf

Code:

# see "man logrotate" for details
# rotate log files weekly
#weekly
daily

# keep 4 weeks worth of backlogs
rotate 1

# create new (empty) log files after rotating old ones
create

# uncomment this if you want your log files compressed
compress

# uncomment these to switch compression to bzip2
compresscmd /usr/bin/bzip2
uncompresscmd /usr/bin/bunzip2

# RPM packages drop log rotation information into this directory
include /etc/logrotate.d

# no packages own wtmp -- we'll rotate them here
#/var/log/wtmp {
#    monthly
#    create 0664 root utmp
#    rotate 1
#}

# system-specific logs may be also be configured here.

And the oldest log:

Code:

-rw-r-----    1 root   root      195031 Oct 31 01:04 warn-20081031.gz
-rw-------    1 root   root          77 Oct 31 01:03 net-snmpd.log-20081031.gz

Does "rotate 1" not say that only one week of logs should be archived ?

aus9 · 12-22-2008, 04:12 AM

hi

IMHO your /etc/logrotate.conf says rotations are

daily
rotate 1

meaning rotate every day.

2) The problem as I see it...is you have specified which files you want in THAT config file and maybe you do not know about
/etc/logrotate.d

which is where you are going to find a heap of rotate config files.

here my main one from that new folder

--------------------------------
/var/log/syslog
/var/log/messages
{
rotate 7
daily
missingok
notifempty
delaycompress
compress
postrotate
invoke-rc.d rsyslog reload > /dev/null
endscript
}

/var/log/mail.info
/var/log/mail.warn
/var/log/mail.err
/var/log/mail.log
/var/log/daemon.log
/var/log/kern.log
/var/log/auth.log
/var/log/user.log
/var/log/lpr.log
/var/log/cron.log
/var/log/debug
{
rotate 4
weekly
missingok
notifempty
compress
delaycompress
sharedscripts
postrotate
invoke-rc.d rsyslog reload > /dev/null
endscript
}
-----------------------------------------------

2) I also tend as root to issue a command of force

see man logrotate...on its use pls

saavik · 12-22-2008, 04:26 AM

I see.

So here the logrotate.d

Code:

/var/log/warn /var/log/messages /var/log/allmessages /var/log/localmessages /var/log/firewall {
    compress
    dateext
    maxage 365
    rotate 99
    missingok
    notifempty
    size +4096k
    create 640 root root
    sharedscripts
    postrotate
        /etc/init.d/syslog reload
    endscript
}

Is it the line

"maxage 365
rotate 99"

??

trickykid · 12-23-2008, 09:50 AM

rotate 1

You're telling it to literally keep a weeks worth of logs not including the existing ones still in use or being written to.

If you don't want any saved logs and only want the current ones in use, just make it rotate 0 in your config, it'll discard them once they're rotated or cleared out.

Personally I always keep at least a week worth of logs on hand. They're usually small and don't affect anything, good for auditing if something happens, etc. Any reason you don't want to keep any on hand?

saavik · 05-08-2009, 12:51 AM

Sorry, but I simply don't get it:

Code:

# cat /etc/logrotate.d/syslog 
/var/log/warn /var/log/messages /var/log/allmessages /var/log/localmessages /var/log/firewall {
    compress
    dateext
    maxage 14
    rotate 99
    missingok
    notifempty
    size +4096k
    create 640 root root
    sharedscripts
    postrotate
        /etc/init.d/syslog reload
    endscript
}

/var/log/mail /var/log/mail.info /var/log/mail.warn /var/log/mail.err {
    compress
    dateext
    maxage 14
    rotate 99
    missingok
    notifempty
    size +4096k
    create 640 root root
    sharedscripts
    postrotate
        /etc/init.d/syslog reload
    endscript
}

Code:

proxyftp:/var/log # cat /etc/logrotate.conf 
# see "man logrotate" for details
# rotate log files weekly
#weekly
daily

# keep 4 weeks worth of backlogs
rotate 4

# create new (empty) log files after rotating old ones
create

# uncomment this if you want your log files compressed
compress

# uncomment these to switch compression to bzip2
#compresscmd /usr/bin/bzip2
#uncompresscmd /usr/bin/bunzip2

# RPM packages drop log rotation information into this directory
include /etc/logrotate.d

# no packages own wtmp -- we'll rotate them here
#/var/log/wtmp {
#    monthly
#    create 0664 root utmp
#    rotate 1
#}

# system-specific logs may be also be configured here.

I started

Code:

proxyftp:/var/log # logrotate -f /etc/logrotate.conf 
Reload httpd2 (graceful restart)                                                                                                                  done
Reload httpd2 (graceful restart)                                                                                                                  done
Reload syslog service                                                                                                                             done
Reload syslog service                                                                                                                             done
proxyftp:/var/log # ls -alt mes*
-rw-r-----  1 root root  5551217 May  8 07:48 messages
-rw-r--r--  1 root root    19496 May  8 07:48 messages.new
-rw-r-----  1 root root  1121302 May  8 04:15 messages-20090508.gz
-rw-r-----  1 root root  1156351 May  7 04:15 messages-20090507.gz
-rw-r-----  1 root root  1173469 May  6 04:15 messages-20090506.gz
-rw-r-----  1 root root  2039234 May  5 04:15 messages-20090505.gz
-rw-r-----  1 root root   933998 May  2 04:15 messages-20090502.gz
-rw-r-----  1 root root  1135674 May  1 04:15 messages-20090501.gz
-rw-r-----  1 root root  1126240 Apr 30 04:15 messages-20090430.gz
-rw-r-----  1 root root  1209114 Apr 29 04:15 messages-20090429.gz
-rw-r-----  1 root root  2411292 Apr 28 04:15 messages-20090428.gz
...
..
.
-rw-r-----  1 root root  1173511 Mar 12 04:15 messages-20090312.gz
-rw-r-----  1 root root  1200814 Mar 11 04:15 messages-20090311.gz
-rw-r-----  1 root root  2434338 Mar 10 04:15 messages-20090310.gz
-rw-r-----  1 root root   422607 Mar  9 04:15 messages-20090309.gz
-rw-r-----  1 root root   423758 Mar  8 04:15 messages-20090308.gz
-rw-r-----  1 root root  1351126 Mar  7 04:15 messages-20090307.gz
-rw-r-----  1 root root  1387505 Mar  6 04:15 messages-20090306.gz
-rw-r-----  1 root root 11535861 May 13  2008 messages-20080513

Why are the logs of March still there ?

chrism01 · 05-08-2009, 02:19 AM

iirc, it only affects files its currently or will in future process. Old files you remove manually.