The premise I started from might have been wrong all along. I thought logrotate is simply a sort of dumb script that does things in a more secure and efficient way than you'd do with a normal script. So I thought that the same files were going to be dealt with the same in different contexts (moving them to another directory, another os altogether, etc.).
But I think it uses a sort of internal register in order to link these files, right? It creates a sort of chain and that's how it knows how to rotate them. It's not as simple as find and exec remove plus a mere if condition to remove the files only if there are less than x.
So where would this 'register' reside then? Is it the /var/lib/logrotate.status? But that's clearly not enough info, right? There must be something else too.
Yesterday I copied around 8 spooler files with suffixed data (file-YYYYMMDD). One was simply called "spooler". So I tried to rotate them, nothing happened, then I changed the system date (two months in the future, using weekly and rotate 5 + compress). For
each file it created another archive:
Code:
ll
total 32
-rw-------. 1 root root 0 Oct 19 2018 spooler
-rw-r--r--. 1 root root 0 Oct 19 2018 spooler-20180219
-rw-r--r--. 1 root root 20 Feb 19 15:30 spooler-20180219-20181019.gz
-rw-r--r--. 1 root root 0 Oct 19 2018 spooler-20180319
-rw-r--r--. 1 root root 20 Mar 19 15:30 spooler-20180319-20181019.gz
-rw-r--r--. 1 root root 0 Oct 19 2018 spooler-20180419
-rw-r--r--. 1 root root 20 Apr 19 15:30 spooler-20180419-20181019.gz
-rw-------. 1 root root 0 Oct 19 2018 spooler-20180619
-rw-------. 1 root root 20 May 4 15:31 spooler-20180619-20181019.gz
-rw-------. 1 root root 0 Oct 19 2018 spooler-20180719
-rw-------. 1 root root 20 Jun 19 2018 spooler-20180719-20181019.gz
-rw-------. 1 root root 0 Oct 19 2018 spooler-20180819
-rw-------. 1 root root 20 Jul 19 2018 spooler-20180819-20181019.gz
-rw-------. 1 root root 0 Oct 19 2018 spooler-20180919
-rw-------. 1 root root 20 Aug 19 2018 spooler-20180919-20181019.gz
-rw-------. 1 root root 20 Sep 19 2018 spooler-20181019.gz
Which leads me to believe that each file is considered the 'original' file so logrotate would expect further input for each and every file. So it didn't actually take into account either mtime (which as far as I can tell is relevant only for the maxage condition), or the suffix in the name (the latter would be expected, after all, I guess)
LATER EDIT: So what is important to know (also from what you've been telling me so far) is that logrotate expects a single file to start with, then it creats its own database/register. So if you'd want to move logs to another server, for instance, that could be a problem, right, if you'd like to keep lots of log files, maybe daily backups for 6 months or so, and you still want to use logrotate on another OS without losing the logs, or the rotation mechanism.