rsyslog: what time does rotation happen?

elfoozo · 08-24-2009, 01:11 AM

So as I get older... I'm having this problem remembering how I set rotation of my (mail).logs at around 23:58 instead of the default 6:24 AM. It's been about a year ago. I do remember it was quite the hunt to find the actual buried spot Debian invoked rotation of mail.logs from.

Google loves to tell me how to customize the logrotate settings for which sets of files... just not what time rotation on a specific set of files gets invoked.

Does anyone know off the top of their head?

acid_kewpie · 08-24-2009, 07:44 AM

It doesn't does it? logrotate would handle this, not a syslog daemon.

elfoozo · 08-24-2009, 09:44 AM

You're right Chris, rsyslog doesn't rotate itself. Original post reworded to try and clarify my situation. Thanks!

AlucardZero · 08-24-2009, 10:27 AM

/etc/crontab ?

elfoozo · 08-24-2009, 10:58 AM

contents of /etc/crontab on my modified system:

Code:

# m h dom mon dow user  command
17 *    * * *   root    cd / && run-parts --report /etc/cron.hourly
25 6    * * *   root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily )
47 6    * * 7   root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.weekly )
52 6    1 * *   root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.monthly )

my (previously modified) mail.log* 'timestamp':

Code:

ls -lh /var/log/mail.log*
-rw-r----- 1 root adm 3.6K 2009-08-24 10:12 /var/log/mail.log
-rw-r----- 1 root adm  13K 2009-08-23 00:15 /var/log/mail.log.1
-rw-r----- 1 root adm  813 2009-08-16 00:12 /var/log/mail.log.2.gz
-rw-r----- 1 root adm  928 2009-08-09 00:10 /var/log/mail.log.3.gz
-rw-r----- 1 root adm 1.1K 2009-08-02 00:28 /var/log/mail.log.4.gz

which is the same as a stock system:

Code:

# m h dom mon dow user  command
17 *    * * *   root    cd / && run-parts --report /etc/cron.hourly
25 6    * * *   root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily )
47 6    * * 7   root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.weekly )
52 6    1 * *   root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.monthly )

but not the same 'time' on a stock system:

Code:

ls -lh /var/log/mail.log*
-rw-r----- 1 root adm 304K 2009-08-24 11:51 /var/log/mail.log
-rw-r----- 1 root adm 1.1M 2009-08-24 06:25 /var/log/mail.log.0
-rw-r----- 1 root adm 214K 2009-08-23 06:25 /var/log/mail.log.1.gz
-rw-r----- 1 root adm 230K 2009-08-21 06:25 /var/log/mail.log.2.gz
-rw-r----- 1 root adm 156K 2009-08-19 06:25 /var/log/mail.log.3.gz
-rw-r----- 1 root adm 256K 2009-08-18 06:25 /var/log/mail.log.4.gz
-rw-r----- 1 root adm 108K 2009-08-16 06:46 /var/log/mail.log.5.gz
-rw-r----- 1 root adm 134K 2009-08-15 06:25 /var/log/mail.log.6.gz

open to further suggestions, thanks!

acid_kewpie · 08-24-2009, 12:45 PM

there will be a logrotate script in /etc/cron.d/daily, which is run according to that crontab entry you posted.

elfoozo · 08-24-2009, 02:04 PM

I am missing the connection of the dots . . .

When I "cat logrotate"

Code:

#!/bin/sh

test -x /usr/sbin/logrotate || exit 0
/usr/sbin/logrotate /etc/logrotate.conf

There is not much in there (logrotate.conf) that clues me in to what time log rotation is called on the modified system vs. a default installed system. Cron seems to be configured the same on both systems and there are no other crons hiding in /var/spool/cron/crontabs/*.