topic logrotate question/problem in Operating System - Linux

logrotate question/problem

joseph wholey — Tue, 27 Jun 2006 11:48:29 GMT

I rotate my logs daily, but am having a problem with my maillog growing too large. It does not seem to be adhering to the parameters set in /etc/logrotate.conf. Here is what I have in /etc/logrotate.conf. I expect to keep 4 versions of any log and don't expect the log to grow greater than 100M at any time. Below is my /etc/logrotate.conf. Shouldn't "size 100M" do what I expect. i.e. rotate the logs when it hits 100M. /var/log/maillog is defined in /etc/logrotate.d/syslog. What am I missing?

# see "man logrotate" for details
# rotate log files weekly
#weekly

# commented out weekly and changed to size due to e-mail errors
size 100M

# keep 4 weeks worth of backlogs
rotate 4

# create new (empty) log files after rotating old ones
create

# uncomment this if you want your log files compressed
#compress

# RPM packages drop log rotation information into this directory
include /etc/logrotate.d

# no packages own wtmp -- we'll rotate them here
/var/log/wtmp {
monthly
create 0664 root utmp
rotate 1
}

Re: logrotate question/problem

Rick Garland — Tue, 27 Jun 2006 12:47:37 GMT

Place the "size 100M" statement in the stanza specific to maillog in the '/etc/logrotate.d'

Re: logrotate question/problem

joseph wholey — Tue, 27 Jun 2006 12:57:37 GMT

Rick,
I don't have a specific file/stanza for mail in my /etc/logrotate.d directory. /var/log/maillog is included in /etc/logrotate.d/syslog. Shouldn't that be enough?
I can't seem to find any documentation on how logs specified in the /etc/logrotate.d/syslog are treated. thx. -joe-

Re: logrotate question/problem

Ivan Ferreira — Tue, 27 Jun 2006 14:12:27 GMT

Are you sure is rotating in daily basis? Because I don't see the "daily" option in your configuration file.

Re: logrotate question/problem

joseph wholey — Tue, 27 Jun 2006 14:48:32 GMT

Ivan,

Correct me if I'm wrong... and I very well could be... but I thought it went as follows:

1. start crond
2. crond searches /etc/crontab and /etc/cron.d for programs to run.
3. run-parts in root's crontab executes cron.daily/hourly/weekly etc...
4. logrotate runs out of /etc/cron.daily
5. /etc/logrotate.conf is read by /etc/cron.daily/logrotate
6. /etc/logrotate.conf includes files that are in /etc/logrotate.d directory
7. /etc/logrotate.d/syslog specifies /var/log/maillog

...so I'm pretty sure it is running? + this is from my /var/lib/rotate.status.

"/var/log/maillog" 2006-6-26

thx. joe

Re: logrotate question/problem

Ivan Ferreira — Tue, 27 Jun 2006 15:02:53 GMT

I think that the exact process will be:

1. start crond
2. crond searches /etc/crontab and /etc/cron.d for programs to run.
3. run-parts in root's crontab executes cron.daily/hourly/weekly etc...
4. logrotate runs out of /etc/cron.daily
5. /etc/logrotate.conf is read by /etc/cron.daily/logrotate
6. /etc/logrotate.conf includes files that are in /etc/logrotate.d directory
7. /etc/logrotate.d/syslog specifies /var/log/maillog
***8. If the logrotate.conf is configured to be executed in daily basis with the daily parameter, or if there are some log files configured to be rotated daily, then continues, if not, waits until the next run.

Anyway, you can use logrotate -f to "force" and test the rotation of the log files. Also, consider that the files may grow beyond the 100 MB because logrotate runs only once at the day, and won't monitor the file so when exactly 100 MB is reached will be rotated.

Re: logrotate question/problem

Steven E. Protter — Tue, 27 Jun 2006 17:49:07 GMT

Shalom,

Based on a thorough reading of the thread, I'd suggest changing the cron schedule for logrotate.

If 100 MB is important to you than run logrotate more often. All its going to do is nothing if the parameters are not met.

We like to run it on a fixed schedule so we know the time span of log contents. Its not like its from Mount Sinai or anything, you can do what you want.

SEP

Re: logrotate question/problem

Stuart Browne — Tue, 27 Jun 2006 19:02:31 GMT

We rotate our mail log every hour (outside of logrotate though, as it doesn't like hourly), and keep about a months worth.

I agreep with SEP though.

If the 100MB is important, then run logrotate more regularly than once-a-day. 'logrotate' will handle the logs correctly, as it keeps it's own records as to when it's rotated something.

Re: logrotate question/problem

joseph wholey — Thu, 29 Jun 2006 10:17:45 GMT

Ok... still haven't received a satisfactory explanation as to why the 100MB is not being honored... but, I'm putting logrotate into /etc/cron.hourly to circumvent.

Re: logrotate question/problem

Ivan Ferreira — Thu, 29 Jun 2006 11:22:20 GMT

Remember to use the -f option or logrotate wont run two times the same day.