confused about use of logrotate and cron.daily

someshpr · 07-13-2012, 10:12 PM

Hi,

Recently I saw that my syslog and daemon.log files in /var/log directory are huge (7G each). They were eating up all the diskspace in my / directory. So to save some space I truncated the daemon.log using the truncate command and restarted the laptop. There were a lot of errors while shutting down but eventually things became normal.

So far so good.

Now I was looking about limiting size of logfiles. And found that I can use logrotate as a cron job to do so (http://www.thegeekstuff.com/2010/07/logrotate-examples/) As per the guide, I poked around in my configurations. Here is how things look:

Code:

somesh@creativision:/etc/logrotate.d$ crontab -l
no crontab for somesh

Code:

somesh@creativision:/etc/logrotate.d$ cd /etc/cron.daily/
somesh@creativision:/etc/cron.daily$ ll
total 76
-rwxr-xr-x 1 root root   311 Mar  9  2008 0anacron
-rwxr-xr-x 1 root root 14799 Apr 15  2011 apt
-rwxr-xr-x 1 root root   314 Dec  4  2008 aptitude
-rwxr-xr-x 1 root root   502 Nov 20  2007 bsdmainutils
-rwxr-xr-x 1 root root   256 Apr 26  2011 dpkg
-rwxr-xr-x 1 root root  4109 May 12  2011 exim4-base
-rwxr-xr-x 1 root root  7623 Jul  9 21:29 google-chrome
lrwxrwxrwx 1 root root    45 Jun 26 08:31 google-talkplugin -> /opt/google/talkplugin/cron/google-talkplugin
-rwxr-xr-x 1 root root   580 Sep 23  2008 htdig
-rwxr-xr-x 1 root root    89 Oct  8  2008 logrotate
-rwxr-xr-x 1 root root  1335 Jan  2  2011 man-db
-rwxr-xr-x 1 root root   606 Nov  4  2009 mlocate
-rwxr-xr-x 1 root root  1154 Nov 22  2009 ntp
-rwxr-xr-x 1 root root   249 Feb 15  2011 passwd
-rwxr-xr-x 1 root root  3594 Dec 18  2010 standard

Code:

somesh@creativision:/etc/cron.daily$ cat logrotate 
#!/bin/sh

test -x /usr/sbin/logrotate || exit 0
/usr/sbin/logrotate /etc/logrotate.conf

Code:

somesh@creativision:/etc/logrotate.d$ cat /etc/logrotate.conf 
# see "man logrotate" for details
# rotate log files weekly
weekly

# keep 4 weeks worth of backlogs
rotate 4

# create new (empty) log files after rotating old ones
create

# uncomment this if you want your log files compressed
#compress

# packages drop log rotation information into this directory
include /etc/logrotate.d

# no packages own wtmp, or btmp -- we'll rotate them here
/var/log/wtmp {
    missingok
    monthly
    create 0664 root utmp
    rotate 1
}

/var/log/btmp {
    missingok
    monthly
    create 0660 root utmp
    rotate 1
}

# system-specific logs may be configured here

Code:

somesh@creativision:/etc/logrotate.d$ ll
total 52
-rw-r--r-- 1 root root 173 Apr 15  2011 apt
-rw-r--r-- 1 root root  79 Dec  4  2008 aptitude
-rw-r--r-- 1 root root 135 Feb 24  2010 consolekit
-rw-r--r-- 1 root root 248 Mar  2  2010 cups
-rw-r--r-- 1 root root 232 Apr 26  2011 dpkg
-rw-r--r-- 1 root root 146 Sep 30  2008 exim4-base
-rw-r--r-- 1 root root 126 Sep 30  2008 exim4-paniclog
-rw-r--r-- 1 root root  94 May 16  2008 hibernate
-rw-r--r-- 1 root root 157 Nov 16  2010 pm-utils
-rw-r--r-- 1 root root  94 Aug  8  2010 ppp
-rw-r--r-- 1 root root 559 Jul 13 22:51 rsyslog
-rw-r--r-- 1 root root 222 Feb  3  2010 squid
-rw-r--r-- 1 root root 114 Oct  2  2006 unattended-upgrades

Code:

somesh@creativision:/etc/logrotate.d$ cat rsyslog
/var/log/syslog
{
        rotate 7
        daily
        missingok
        notifempty
        delaycompress
        compress
        postrotate
                invoke-rc.d rsyslog reload > /dev/null
        endscript
}

/var/log/mail.info
/var/log/mail.warn
/var/log/mail.err
/var/log/mail.log
/var/log/daemon.log
/var/log/kern.log
/var/log/auth.log
/var/log/user.log
/var/log/lpr.log
/var/log/cron.log
/var/log/debug
/var/log/messages
{
        rotate 4
        weekly
        missingok
        notifempty
        compress
        delaycompress
        sharedscripts
        postrotate
                invoke-rc.d rsyslog reload > /dev/null
        endscript
}

My questions are:
1. As far as I know, even if my list of crontab (crontab -l) shows nothing, the files under cron.daily directory work as a daily cronjob. Is that right?
2. Is the daily cron of logrotate looking into all the files in logrotate.d directory ("include /etc/logrotate.d" line in logrotate.conf) and rotating the logs accordingly? Or is it just rotating wtmp and btmp?
3. It seems to me that if I add a line "size 1000000k" in the rsyslog file in logrotate.d, the size of these log files will be limited to 1G. Now will that hamper the performance of my laptop any way?

TIA,

timufea · 07-14-2012, 03:12 AM

1. The cron.daily files will be run by root - if you type the 'crontab -l' command as super-user, you should see that a script is run daily that executes the cron.daily files.

2. logrotate uses all the files in the logrotate.d directory, as a consequence of the include line.

3. You could use "size 1000000k" instead of "daily", to rotate when the file gets too big instead of daily - this shouldn't impact the laptop performance. The real issue is why syslog isn't being rotated daily, since that is what should be happening with this configuration.

Do you turn off your laptop nightly? If so, check the output from the 'crontab -l' to see when the cron.daily files are being run. You may need to edit the crontab to get them run at a time that the laptop is on.

someshpr · 07-14-2012, 10:56 AM

Quote:

Originally Posted by timufea

1. The cron.daily files will be run by root - if you type the 'crontab -l' command as super-user, you should see that a script is run daily that executes the cron.daily files.

2. logrotate uses all the files in the logrotate.d directory, as a consequence of the include line.

3. You could use "size 1000000k" instead of "daily", to rotate when the file gets too big instead of daily - this shouldn't impact the laptop performance. The real issue is why syslog isn't being rotated daily, since that is what should be happening with this configuration.

Do you turn off your laptop nightly? If so, check the output from the 'crontab -l' to see when the cron.daily files are being run. You may need to edit the crontab to get them run at a time that the laptop is on.

Thanks timufea!

The crontab list for super-user also seems to be empty

Code:

somesh@creativision:~$ sudo crontab -l
no crontab for root
somesh@creativision:~$ su
Password: 
creativision:/home/somesh# crontab -l
no crontab for root
creativision:/home/somesh#

So is the cron.daily logrotate is not running at all?

On the last note: Yes, I do turn off or put it to sleep nightly. So if the cron job is set to run late at night, it may not be able to logrotate at all. But I cannot find any time schedule for the cron.daily jobs.

TIA

timufea · 07-14-2012, 11:19 AM

You are probably running a version of cron (e.g. "Vixie Cron") that has a system-wide config file '/etc/crontab' - the times for cron.daily etc. will be there. You can, as root, simply edit this file - you don't need to use 'crontab -e'.

If you can't choose a time of day when your laptop will always be on, you could move the logrotate file from cron.daily to cron.hourly. This would run logrotate hourly, but it would still rotate files according to its configuration (daily, weekly, by size, ...).

segmentation_fault · 07-15-2012, 10:25 AM

You can also check out anacron, which runs any crons that should have run by the time anacron is started.