understanding logrotate

Originally Posted by vincix Well, first of all, I don't understand why you'd use postrotate with find. In my view, this defeats the purpose of using logrotate instead of a custom script (which worked for me, as you might have seen in the thread I pointed to). So I expect logrotate to delete old backups through its own mecahisms, without any helping hands (i.e. postrotate with find and -exec). Nonetheless, I'm also interested in how logrotate works inside or outside the context of backup files. So in this respect, you've given me some clues, although I still find it quite hard to understand ll /home/vinci/test -rw-r--r--. 1 root root 0 May 7 22:00 tendaysold cat /etc/logrotate.d/test /home/vinci/test/* { maxage 5 ifempty compress rotate 1 } (I used 'ifempty' to make sure it also takes empty files into consideration, even if that's the default behaviour. And I didn't use maxsize, just to make things simple) logrotate -s /var/log/logstatus /etc/logrotate.conf cat /var/log/logstatus logrotate state -- version 2 "/var/log/yum.log" 2018-5-17-14:0:0 "/var/log/boot.log" 2018-5-17-14:0:0 "/var/log/wtmp" 2018-5-17-14:0:0 "/var/log/chrony/*.log" 2018-5-17-14:0:0 "/var/log/spooler" 2018-5-17-14:0:0 "/var/log/btmp" 2018-5-17-14:0:0 "/var/log/maillog" 2018-5-17-14:0:0 "/var/log/wpa_supplicant.log" 2018-5-17-14:0:0 "/var/log/secure" 2018-5-17-14:0:0 "/var/log/messages" 2018-5-17-14:0:0 "/home/vinci/test/tendaysold" 2018-5-17-14:0:0 "/var/log/cron" 2018-5-17-14:0:0 I'm guessing the timestamps that logrotate suffixes point to the moment logrotate look at those files. Nothing happens with my file

one: the postrotate code I got off the web and just modded it to delete everything older than. So it was not my idea, I was just showing someone else idea.

two: From what I've seen and said about it from deducing the events I seen take place. That date older than, or anything to do with removing old logs. I'd safely say only applies to logrotate backup files that logrotate created as backup files. everything else is seen as a running log file, and is being treated as so. that is why you cannot get it to delete any of them. the defining pattern would be <period><some number to indicate its succussion in the backed up log of same name>

test.bkp <original> if it meets the size or date requirement, it gets dumped into a back up log file. and a empty one of the same name remains. then recreates these backups each time it meets the first requirements,
test.bkp.1 <-- here to
test.bkp.2
test.bkp.3 <-- here: these are the ones it takes into concentration for deleting, using rotate, nothing more than that. Which makes perfect sense to me that this is a self contained program. Meaning it only monitors the log files you tell it to then creates back ups for you of its own doing then maintains them as well. using rotate and compress, and the empty call would be to just act on it and create a back up of it even if it is empty, though I have not tried it to confirm that suspicion.


I didn't jump over to look at your other post. I just took your word for it.

The premise I started from might have been wrong all along. I thought logrotate is simply a sort of dumb script that does things in a more secure and efficient way than you'd do with a normal script. So I thought that the same files were going to be dealt with the same in different contexts (moving them to another directory, another os altogether, etc.).
But I think it uses a sort of internal register in order to link these files, right? It creates a sort of chain and that's how it knows how to rotate them. It's not as simple as find and exec remove plus a mere if condition to remove the files only if there are less than x.

So where would this 'register' reside then? Is it the /var/lib/logrotate.status? But that's clearly not enough info, right? There must be something else too.

Yesterday I copied around 8 spooler files with suffixed data (file-YYYYMMDD). One was simply called "spooler". So I tried to rotate them, nothing happened, then I changed the system date (two months in the future, using weekly and rotate 5 + compress). For each file it created another archive:

ll
total 32
-rw-------. 1 root root  0 Oct 19  2018 spooler
-rw-r--r--. 1 root root  0 Oct 19  2018 spooler-20180219
-rw-r--r--. 1 root root 20 Feb 19 15:30 spooler-20180219-20181019.gz
-rw-r--r--. 1 root root  0 Oct 19  2018 spooler-20180319
-rw-r--r--. 1 root root 20 Mar 19 15:30 spooler-20180319-20181019.gz
-rw-r--r--. 1 root root  0 Oct 19  2018 spooler-20180419
-rw-r--r--. 1 root root 20 Apr 19 15:30 spooler-20180419-20181019.gz
-rw-------. 1 root root  0 Oct 19  2018 spooler-20180619
-rw-------. 1 root root 20 May  4 15:31 spooler-20180619-20181019.gz
-rw-------. 1 root root  0 Oct 19  2018 spooler-20180719
-rw-------. 1 root root 20 Jun 19  2018 spooler-20180719-20181019.gz
-rw-------. 1 root root  0 Oct 19  2018 spooler-20180819
-rw-------. 1 root root 20 Jul 19  2018 spooler-20180819-20181019.gz
-rw-------. 1 root root  0 Oct 19  2018 spooler-20180919
-rw-------. 1 root root 20 Aug 19  2018 spooler-20180919-20181019.gz
-rw-------. 1 root root 20 Sep 19  2018 spooler-20181019.gz

Which leads me to believe that each file is considered the 'original' file so logrotate would expect further input for each and every file. So it didn't actually take into account either mtime (which as far as I can tell is relevant only for the maxage condition), or the suffix in the name (the latter would be expected, after all, I guess)

LATER EDIT: So what is important to know (also from what you've been telling me so far) is that logrotate expects a single file to start with, then it creats its own database/register. So if you'd want to move logs to another server, for instance, that could be a problem, right, if you'd like to keep lots of log files, maybe daily backups for 6 months or so, and you still want to use logrotate on another OS without losing the logs, or the rotation mechanism.

This thing is really usefull for logfiles. Maybe you have a difficult setup time because how logrotate is setup in your system to suit log rotating jobs.

You could setup logrotate for your user instead, maybe that would be simpler

create a minimal directory structure

cd /home/vinci
mkdir -p var/lib
mkdir -p etc

Then create /home/vinci/etc/logrotate.conf

compress
rotate 3

/home/vinci/test/test.bkp {
    ifempty
    rotate 5
}

Now use logrotate as vinci user

logrotate -s /home/vinci/var/lib/logrotate.status \
/home/vinci/etc/logrotate.conf