[SOLVED] do I need to add entry to logrotate?

plisken · 03-03-2014, 12:05 PM

I've in the past added many entries to the logrotate.conf file, normally to deal with web logs and such, even mail folders but I was wondering if I need to add an entry in this case.
I'm adding an ntp.log file and got me thinking, is there a default "rule" for logs that reside in /var/log and have no specific entry in the logrotate file?

rtmistler · 03-05-2014, 07:45 AM

That's hard to figure. (1) you marked this as solved. My personal preference is if you do self-resolve; do mark the thread as solved, but add another comment, or edit your original comment to indicate what you did to resolve it or understand it. (2) there are general rules which one can use, I actually don't use logrotate for system logs, but instead for application logs which are in a customized location on my systems. But you can use wildcards and specify all files in a given directory and such.

What did you end up doing or concluding?

plisken · 03-09-2014, 01:57 PM

I should have deleted the post to be honest, but couldn't figure out how to, apologies...

Code:

/var/log/ntp.log {
size 200k
rotate 4
create
}

I guess my query was that if a logrotate rule didn't exist, then was there a default rule covering the default log location?

Example being that any logs or files which reside in /var/log would be rotated based on a max file size or something, should there not be a specific rule in the logrotate.conf file.

Was such a trivial point, that a few added lines as above just to be safe.

Cheers

rtmistler · 03-10-2014, 07:05 AM

My understanding is that it will not do anything without a conf file; however one can specify a specific conf file or let it use /etc/logrotate.conf and there usually is a default conf file created; but I think it's more of an example versus.

tronayne · 03-10-2014, 08:13 AM

Just to chime in, as a general rule I do not mess with .conf files unless I have a really, really good reason for doing so -- Slackware does a pretty good job of configuring stuff by default, methinks.

That being said, logroate does what you tell it in your files in /etc/logrotate.d and you can fancy those up to your heart's content. Rotate on size, rotate weekly irrespective of size, compress, don't compress, whatever.

Since you provided an example for NTP log rotation, here' another example (the one I use):

Code:

/var/log/ntp.log {
  rotate 10
  notifempty
  missingok
  compress
  delaycompress
  sharedscripts
  postrotate
    /etc/rc.d/rc.ntpd restart
  endscript
}

As of right now, the logs look like this:

Code:

ls -l /var/log/ntp*
-rw-r--r-- 1 root root  1248 Mar 10 09:01 /var/log/ntp.log
-rw-r--r-- 1 root root 12002 Mar 10 04:40 /var/log/ntp.log.1
-rw-r--r-- 1 root root  1042 Mar  2 04:40 /var/log/ntp.log.2.gz
-rw-r--r-- 1 root root  1497 Feb 24 04:40 /var/log/ntp.log.3.gz
-rw-r--r-- 1 root root   619 Feb 16 04:40 /var/log/ntp.log.4.gz

That's what the delaycompress does; ntp.log.1 won't get compressed until next Sunday.

You can get some good hints just reading through the default rotate files provided with Slackware -- I'm not that smart, I cobbled together the NTP rotate file from one of the defaults, sneaky but effective, eh?

Hope this helps some.

Richard Cranium · 03-11-2014, 01:56 AM

Quote:

Originally Posted by plisken

is there a default "rule" for logs that reside in /var/log and have no specific entry in the logrotate file?

The contents of /etc/logrotate.d are used to handle various log files but there's no default for random files in /var/log or its subdirectories.