Latest LQ Deal: Complete CCNA, CCNP & Red Hat Certification Training Bundle
Go Back > Forums > Linux Forums > Linux - Newbie
User Name
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!


  Search this Thread
Old 05-17-2018, 03:31 PM   #16
LQ Guru
Registered: Sep 2013
Distribution: Slackware 14.2 / Slackware 14.2 current / Manjaro
Posts: 6,676

Rep: Reputation: 1336Reputation: 1336Reputation: 1336Reputation: 1336Reputation: 1336Reputation: 1336Reputation: 1336Reputation: 1336Reputation: 1336Reputation: 1336

Originally Posted by vincix View Post
Well, first of all, I don't understand why you'd use postrotate with find. In my view, this defeats the purpose of using logrotate instead of a custom script (which worked for me, as you might have seen in the thread I pointed to). So I expect logrotate to delete old backups through its own mecahisms, without any helping hands (i.e. postrotate with find and -exec).
Nonetheless, I'm also interested in how logrotate works inside or outside the context of backup files. So in this respect, you've given me some clues, although I still find it quite hard to understand
ll /home/vinci/test
-rw-r--r--. 1 root root 0 May  7 22:00 tendaysold
cat /etc/logrotate.d/test
/home/vinci/test/* {
	maxage 5
	rotate 1
(I used 'ifempty' to make sure it also takes empty files into consideration, even if that's the default behaviour. And I didn't use maxsize, just to make things simple)

logrotate -s /var/log/logstatus /etc/logrotate.conf
cat /var/log/logstatus
logrotate state -- version 2
"/var/log/yum.log" 2018-5-17-14:0:0
"/var/log/boot.log" 2018-5-17-14:0:0
"/var/log/wtmp" 2018-5-17-14:0:0
"/var/log/chrony/*.log" 2018-5-17-14:0:0
"/var/log/spooler" 2018-5-17-14:0:0
"/var/log/btmp" 2018-5-17-14:0:0
"/var/log/maillog" 2018-5-17-14:0:0
"/var/log/wpa_supplicant.log" 2018-5-17-14:0:0
"/var/log/secure" 2018-5-17-14:0:0
"/var/log/messages" 2018-5-17-14:0:0
"/home/vinci/test/tendaysold" 2018-5-17-14:0:0
"/var/log/cron" 2018-5-17-14:0:0
I'm guessing the timestamps that logrotate suffixes point to the moment logrotate look at those files.
Nothing happens with my file
one: the postrotate code I got off the web and just modded it to delete everything older than. So it was not my idea, I was just showing someone else idea.

two: From what I've seen and said about it from deducing the events I seen take place. That date older than, or anything to do with removing old logs. I'd safely say only applies to logrotate backup files that logrotate created as backup files. everything else is seen as a running log file, and is being treated as so. that is why you cannot get it to delete any of them. the defining pattern would be <period><some number to indicate its succussion in the backed up log of same name>

test.bkp <original> if it meets the size or date requirement, it gets dumped into a back up log file. and a empty one of the same name remains. then recreates these backups each time it meets the first requirements,
test.bkp.1 <-- here to
test.bkp.3 <-- here: these are the ones it takes into concentration for deleting, using rotate, nothing more than that. Which makes perfect sense to me that this is a self contained program. Meaning it only monitors the log files you tell it to then creates back ups for you of its own doing then maintains them as well. using rotate and compress, and the empty call would be to just act on it and create a back up of it even if it is empty, though I have not tried it to confirm that suspicion.

I didn't jump over to look at your other post. I just took your word for it.

Last edited by BW-userx; 05-17-2018 at 03:44 PM.
Old 05-18-2018, 04:06 AM   #17
Registered: Feb 2011
Distribution: Centos 7
Posts: 903

Original Poster
Rep: Reputation: 74
The premise I started from might have been wrong all along. I thought logrotate is simply a sort of dumb script that does things in a more secure and efficient way than you'd do with a normal script. So I thought that the same files were going to be dealt with the same in different contexts (moving them to another directory, another os altogether, etc.).
But I think it uses a sort of internal register in order to link these files, right? It creates a sort of chain and that's how it knows how to rotate them. It's not as simple as find and exec remove plus a mere if condition to remove the files only if there are less than x.

So where would this 'register' reside then? Is it the /var/lib/logrotate.status? But that's clearly not enough info, right? There must be something else too.

Yesterday I copied around 8 spooler files with suffixed data (file-YYYYMMDD). One was simply called "spooler". So I tried to rotate them, nothing happened, then I changed the system date (two months in the future, using weekly and rotate 5 + compress). For each file it created another archive:
total 32
-rw-------. 1 root root  0 Oct 19  2018 spooler
-rw-r--r--. 1 root root  0 Oct 19  2018 spooler-20180219
-rw-r--r--. 1 root root 20 Feb 19 15:30 spooler-20180219-20181019.gz
-rw-r--r--. 1 root root  0 Oct 19  2018 spooler-20180319
-rw-r--r--. 1 root root 20 Mar 19 15:30 spooler-20180319-20181019.gz
-rw-r--r--. 1 root root  0 Oct 19  2018 spooler-20180419
-rw-r--r--. 1 root root 20 Apr 19 15:30 spooler-20180419-20181019.gz
-rw-------. 1 root root  0 Oct 19  2018 spooler-20180619
-rw-------. 1 root root 20 May  4 15:31 spooler-20180619-20181019.gz
-rw-------. 1 root root  0 Oct 19  2018 spooler-20180719
-rw-------. 1 root root 20 Jun 19  2018 spooler-20180719-20181019.gz
-rw-------. 1 root root  0 Oct 19  2018 spooler-20180819
-rw-------. 1 root root 20 Jul 19  2018 spooler-20180819-20181019.gz
-rw-------. 1 root root  0 Oct 19  2018 spooler-20180919
-rw-------. 1 root root 20 Aug 19  2018 spooler-20180919-20181019.gz
-rw-------. 1 root root 20 Sep 19  2018 spooler-20181019.gz
Which leads me to believe that each file is considered the 'original' file so logrotate would expect further input for each and every file. So it didn't actually take into account either mtime (which as far as I can tell is relevant only for the maxage condition), or the suffix in the name (the latter would be expected, after all, I guess)

LATER EDIT: So what is important to know (also from what you've been telling me so far) is that logrotate expects a single file to start with, then it creats its own database/register. So if you'd want to move logs to another server, for instance, that could be a problem, right, if you'd like to keep lots of log files, maybe daily backups for 6 months or so, and you still want to use logrotate on another OS without losing the logs, or the rotation mechanism.

Last edited by vincix; 05-18-2018 at 04:11 AM.
Old 05-18-2018, 12:44 PM   #18
LQ Guru
Registered: Mar 2004
Distribution: Slackware
Posts: 6,230

Rep: Reputation: 712Reputation: 712Reputation: 712Reputation: 712Reputation: 712Reputation: 712Reputation: 712
This thing is really usefull for logfiles. Maybe you have a difficult setup time because how logrotate is setup in your system to suit log rotating jobs.

You could setup logrotate for your user instead, maybe that would be simpler

create a minimal directory structure
cd /home/vinci
mkdir -p var/lib
mkdir -p etc
Then create /home/vinci/etc/logrotate.conf
rotate 3

/home/vinci/test/test.bkp {
    rotate 5
Now use logrotate as vinci user
logrotate -s /home/vinci/var/lib/logrotate.status \

Last edited by keefaz; 05-18-2018 at 12:46 PM.


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off

Similar Threads
Thread Thread Starter Forum Replies Last Post
logrotate guna_pmk Linux - Server 12 07-06-2012 01:14 PM
Using Logrotate ckiran04 Linux - Server 1 02-04-2012 12:37 AM
[SOLVED] logrotate or logrotate.conf; problems with sftp slufoot80 Linux - Server 1 11-05-2011 07:50 AM
I need a little help with logrotate Udi Linux - Newbie 1 02-02-2009 11:01 AM
logrotate dominant Linux - Newbie 1 02-13-2004 09:28 AM > Forums > Linux Forums > Linux - Newbie

All times are GMT -5. The time now is 10:24 AM.

Main Menu
Write for LQ is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration