Script to delete logfiles older than 1 day

madhumithamohan · 07-06-2011, 05:04 AM

Hi...

I use this below script to delete the logfiles older than 1 day .

find /home/cie101/madhu1 -mtime +1 -exec rm {} \;

and it doesnot work properly.

Can someone help me out??

colucix · 07-06-2011, 05:19 AM

What does "does not work properly" mean? Any error message? Does it not give the expected results? An advice: first try the find command without the -exec rm part, otherwise you might accidentaly delete the wrong files: once you got the desired results, add the -exec rm (or -delete) and run again.

madhumithamohan · 07-06-2011, 05:31 AM

ya thanks for that..i am jus trying in my home dir..so no issues..

This is how the target location looks like and i want to retain only july6th (current date) logs and delete the rest.

[root@ngmlx409 httpd]# ll
total 1258512
-rw-r--r-- 1 root root 18321624 Jul 5 00:59 ite04_access_log.2011-07-04-00_00_00
-rw-r--r-- 1 root root 18348550 Jul 6 00:59 ite04_access_log.2011-07-05-00_00_00
-rw-r--r-- 1 root root 7102807 Jul 6 10:14 ite04_access_log.2011-07-06-00_00_00
-rw-r--r-- 1 root root 711 Jul 5 10:54 ite04_error_log.2011-07-05-00_00_00
-rw-r--r-- 1 root root 60937596 Jul 5 00:59 ite04_rewrite_log.2011-07-04-00_00_00
-rw-r--r-- 1 root root 60877552 Jul 6 00:59 ite04_rewrite_log.2011-07-05-00_00_00
-rw-r--r-- 1 root root 23484268 Jul 6 10:14 ite04_rewrite_log.2011-07-06-00_00_00
-rwxr-x--- 1 root root 800 Jan 26 09:29 log_http_clear
-rw-r----- 1 root root 0 Jul 6 09:07 rewrite_log
-rw-r----- 1 root root 549158912 Jul 5 09:03 rewrite_log_5Jul.tar.gz
-rw-r----- 1 root root 549158912 Jul 6 09:07 rewrite_log_6Jul.tar.gz
-rw-r--r-- 1 root root 0 Jan 17 17:33 ssl_access_log
-rw-r--r-- 1 root root 0 May 19 18:10 ssl_error_log
-rw-r--r-- 1 root root 0 Jan 17 17:33 ssl_request_log

[root@ngmlx409 httpd]# pwd
/var/sitelogs/httpd

[root@ngmlx409 httpd]# find /var/sitelogs/httpd -mtime +1 -exec rm {} \;
[root@ngmlx409 httpd]# ll
total 1258508
-rw-r--r-- 1 root root 18321624 Jul 5 00:59 ite04_access_log.2011-07-04-00_00_00
-rw-r--r-- 1 root root 18348550 Jul 6 00:59 ite04_access_log.2011-07-05-00_00_00
-rw-r--r-- 1 root root 7102807 Jul 6 10:14 ite04_access_log.2011-07-06-00_00_00
-rw-r--r-- 1 root root 711 Jul 5 10:54 ite04_error_log.2011-07-05-00_00_00
-rw-r--r-- 1 root root 60937596 Jul 5 00:59 ite04_rewrite_log.2011-07-04-00_00_00
-rw-r--r-- 1 root root 60877552 Jul 6 00:59 ite04_rewrite_log.2011-07-05-00_00_00
-rw-r--r-- 1 root root 23484268 Jul 6 10:14 ite04_rewrite_log.2011-07-06-00_00_00
-rw-r----- 1 root root 0 Jul 6 09:07 rewrite_log
-rw-r----- 1 root root 549158912 Jul 5 09:03 rewrite_log_5Jul.tar.gz
-rw-r----- 1 root root 549158912 Jul 6 09:07 rewrite_log_6Jul.tar.gz

After executing the script ,i dont get the desired result..

Not sure wher it goes wrong..

colucix · 07-06-2011, 05:31 AM

I saw the other post of yours (please don't duplicate posts, nor hijack existing threads) and looking at the timestamp of the files it's clear now that it fails because of the -atime/-mtime rule of the find command:

Code:

-atime n
      File was last accessed n*24 hours ago.  When find figures out how many 24-hour periods ago the
      file was last accessed, any fractional part is ignored, so to match -atime +1, a file  has  to
      have been accessed at least two days ago.

To find file modified more than 24 hours ago, you have to use -mitime +0. If the files have been modified 0.24 or 0.78 days ago (that is less than one day) the fractional part will be ignored and the files don't match the +0 condition. On the other hand, files modified 1.01 or 1.65 days ago will be treated as if they were modified 1 day ago, that is more than 0. Hope this helps.

colucix · 07-06-2011, 05:35 AM

Quote:

Originally Posted by madhumithamohan

This is how the target location looks like and i want to retain only july6th (current date) logs and delete the rest.

If you want to delete all the files created yesterday (even if they were last modified less than 24 hours ago, e.g. Jul 5 23.59) you have to add the -daystart option:

Code:

-daystart
     Measure  times  (for  -amin,  -atime,  -cmin, -ctime, -mmin, and -mtime) from the beginning of
     today rather than from 24 hours ago.  This option only affects tests which appear later on the
     command line.

madhumithamohan · 07-06-2011, 05:41 AM

ok...if that thee case..

please look at this:
total 16
-rwxr-x--- 1 cie101 users 62 Jul 6 08:43 mad1
-rwxr-x--- 1 cie101 users 437 Jul 6 07:21 mad3
-rw-r----- 1 cie101 users 0 Jul 4 21:21 madd
-rwxr-x--- 1 cie101 users 24 Jul 5 10:10 madfile2
-rwxr-x--- 1 cie101 users 0 Jul 5 10:10 madfile3
-rw-r----- 1 cie101 users 13 Jul 6 11:23 mady
[cie101@ngmlx409 madhu1]$ find /home/cie101/madhu1 -type f -mtime +1 -exec rm -f {} \;
[cie101@ngmlx409 madhu1]$ ll
total 16
-rwxr-x--- 1 cie101 users 62 Jul 6 08:43 mad1
-rwxr-x--- 1 cie101 users 437 Jul 6 07:21 mad3
-rw-r----- 1 cie101 users 0 Jul 4 21:21 madd
-rwxr-x--- 1 cie101 users 24 Jul 5 10:10 madfile2
-rwxr-x--- 1 cie101 users 0 Jul 5 10:10 madfile3
-rw-r----- 1 cie101 users 13 Jul 6 11:23 mady
[cie101@ngmlx409 madhu1]$

In this case...June 4th file must be deleted right??

colucix · 07-06-2011, 05:45 AM

Quote:

Originally Posted by madhumithamohan

In this case...June 4th file must be deleted right??

Only if the current time in your country is 21:21 or later, for the reasons explained above.

madhumithamohan · 07-06-2011, 05:55 AM

ok...i am getting confused with the timestamp stuff rightnow.can you help me with the post #3...

MTK358 · 07-06-2011, 06:04 AM

Note that you can also use "-delete" instead of "-exec rm {} \;".

madhumithamohan · 07-06-2011, 06:12 AM

@post 9

is that the syntax

[cie101@ngmlx409 madhu1]$ find /home/cie101/madhu1 -type f -mtime +1 -delete
find: invalid predicate `-delete'

[cie101@ngmlx409 madhu1]$ find /home/cie101/madu1 -type f -mtime +1 -delete \;
find: invalid predicate `-delete'

Not working...

colucix · 07-06-2011, 06:12 AM

It actually remove the following (older) files, right?

Code:

-rwxr-x--- 1 root root 800 Jan 26 09:29 log_http_clear
-rw-r--r-- 1 root root 0 Jan 17 17:33 ssl_access_log
-rw-r--r-- 1 root root 0 May 19 18:10 ssl_error_log
-rw-r--r-- 1 root root 0 Jan 17 17:33 ssl_request_log

But you used -mtime +1 so that all the files modified more than 47 hours and 59 minutes ago where found (and deleted). If you want to find all the files modified more then 23 hours and 59 minutes ago, you have to use

Code:

-mtime +0

because -mtime treats all the decimal values 0.1, 0.2, 0.3 ... 0.9999 as 0! The condition is +0, that is more than 0 and matches only files modified 1.0000 days ago (or more). If you use +1 it matches files modified 2.0000 days ago (or more) and not yesterday!

Again, if you want to delete all the files created on 5th Jul (even if they were created less than 24 hours ago, for example yesterday night at 23.59) you have to use the -daystart option.

Now try the following:

Code:

find /var/sitelogs/httpd -mtime +0 -exec ls -l {} \;

and look at the difference from the output of:

Code:

find /var/sitelogs/httpd -daystart -mtime +0 -exec ls -l {} \;

After that it should be a little more clear (hopefully).

madhumithamohan · 07-06-2011, 07:23 AM

Thanks a lot for your help..

The reason for which i delete those files is tht the file system gets full and it generates a ticket.So manually i keep deleting it daily,...according to post 3....i have to delete most of the 5th files and retain the 6th...so it looks fine if i use "find /var/sitelogs/httpd -daystart -mtime +0 -exec ls -l {} \;"

But in worst case if we are in need of the 5th supposingly if 6th dint arrive..then taht ll be a problem...So i thought why cant we move the files we grep'd to a new location (say my home dir).In this case the i will always have a backup rite?

I know th eworking of Move (mv) command ...but could you help me out in implementing in my scenario(post 3)?

colucix · 07-06-2011, 07:59 AM

You can first check if logfiles of today are available, then remove the older ones. I mean for example:

Code:

if [[ $(find /var/sitelogs/httpd -daystart -type f -mtime 0 | wc -l) -ne 0 ]]
then
  find /var/sitelogs/httpd -daystart -type f -mtime +0 -exec echo rm {} \;
fi

Note the difference between -mtime 0 and -mtime +0.
Anyway, given your requirement you might try to use logrotate, which is more suitable for this kind of task. For example you can establish a rule to rotate all the logs inside /var/sitelogs/httpd on a daily basis and keep only those ones of the last two days, removing the rest.