Thought it would be straight forward. But life is not at all easy as you may think.

Here is a simple log.conf

And I expected all the files older than 10 days be deleted.

If I do

It comes up with messages 'log does not need rotating' for files even couple of months older.

If I do

It deletes all the files even if they are few seconds old.

Have I misunderstood the logrotate or is the conf wrong or am I missing something?

Here is the configuration:
CentOS 5
logrotate 3.7.4-9

Thanks

Just Follow this


/my/path/to/logfiles/* {
daily
rotate 10
compress
copytruncate
notifempty
missingok
postrotate
/bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null || true
endscript
}


Here log will rotate daily and take backup of last 10 days log. log will be saved as .gz format

Thanks for your reply hasan_sust.

But all I want is,

* run the log rotate everyday (which is obviously done by the cron.daily)
* check if the file is older than 10 days
* throw it away if so

what is wrong with my config?

Cheers

rotate 10
It will keep files of last 10 days and delete older files.

in your configuration you mention rotate 0>> that's why It deletes all the files even if they are few seconds old.

Hope you understand this point.

to rotate log manually, you have to give the following command

logrotate -f log.conf


For you fiirst query>> run the log rotate everyday (which is obviously done by the cron.daily)

logrotate is run as a daily cron job. in /etc/cron.daily there is a file name logrotate. that's why it executes daily

Thanks hasan.

Let's say I have the following files in /my/path/to/logfiles:

-rw-r--r-- 1 user user 11K May 16 12:37 file1.log
-rw-r--r-- 1 user user 250 May 17 09:54 file2.log
-rw-r--r-- 1 user user 22K May 14 10:41 file3.log
-rw-r--r-- 1 user user 1.3K Jun 19 13:43 file4.log
-rw-r--r-- 1 user user 1.7K Jun 29 11:14 file5.log
-rw-r--r-- 1 user user 36K Jun 25 12:35 file6.log
-rw-r--r-- 1 user user 37K Jun 29 14:18 file7.log

and with the original config, I expect files file1,2 and 3 to be deleted.

From the man page, for rotate, I understand that it will keep given number of copies of a file. For example, in the above list, if file1 is more than 10 days older, it will be copied to file1.log.1(for example) and after another 10 days it will be moved to file1.log.2 upto file1.log.10 and then deleted after that.I don't think it is something like what you have said (that's what the maxage is for). rotate will simply keep the given number of copies either compressed or not depending upon the compress/nocompress parameter. A rotate 0 will just delete the file when a condition is met (like daily, monthly, maxage, size etc).

Additionally the -f option is to force the logrotation even if logrotate thinks that a file is not ready for a rotation (f is not for file but force).

Please let me know if I have misunderstood.

Cheers

maxage will delete rotated logs only, not the original files. And with rotate 0 you avoid creating log files.

So, the question is: what has to be older than ten days? The original files, or the rotated ones (being compressed or not). Do you get so many files just in ten days?

Hi Reuti,

Thanks.

I think that's what I have misunderstood. You are right. maxage removes the rotated files of count days. I have misunderstood it to the maxage of the actual files.

To answer your question, I want the actual file to be removed (without rotating) if it is older than 10 days. I think I have given a use case in #5.

10 days is just an example case. Practically it will be between 30 to 90 days on different situations.

Please let me know if you need more information in this regard.

Cheers

But stuff is added to the logfiles by the syslog several times a day. Do you want the files to be removed if nothing was added for ten days, and so modification date wasn’t updated? And if you do so, all old information therein would be gone.

Yeah, that's fine. I do not care whatever that is in the file. I do not want them anyhow after the x number of days.

PS: To be honest those are the log files created by a set of automated scripts developed by me. They provide some forensic information about any failures and will not be needed after few days.

This is no task for logrotate then IMO. A plain cron job where you look for the modification date and delete the files would do already. Create a file in /etc/cron.daily:

1 members found this post helpful.

Hi,

I was some time ago setting the logrotate for a custom log file from this example.

It's quite straightforward.

My log file is daily rotated (keeping previous day compressed):
by that "rotate 1" keeps only one archived log and current file.

Thanks Guys,

Reuti has got a point there. In fact, that is how I have implemented it currently.

The reason I wanted to move towards logrotate is because it is a standard way of 'handling' the log files. Whether it is the right way or not should the logrotate not be working for this task?

Anyhow, I am not going to spend much time on this. I going to stay with the current setup.

This would actually be the better way to do it as you won't end up with errors from just deleting the files. It will just truncate them.