delete all old syslog.x.gz files automatically

['chris']

hi

howto delete all old syslog.x.gz files in /var/log automatically ?
my Debian Sarge Stable server produced many syslog files.

I'd like to delte all syslog.gz files older then 1 week.

in /etc/logrotate.d I cannot find syslog:

# cd /etc/logrotate.d
ns1:/etc/logrotate.d# ls -la
insgesamt 44
drwxr-xr-x 2 root root 4096 2005-06-25 18:40 .
drwxr-xr-x 104 root root 4096 2005-06-25 18:17 ..
-rw-r--r-- 1 root root 240 2005-05-12 07:36 apache2
-rw-r--r-- 1 root root 79 2005-04-07 15:43 aptitude
-rw-r--r-- 1 root root 384 2005-05-15 21:00 base-config
-rw-r--r-- 1 root root 172 2005-04-19 16:27 cupsys
-rw-r--r-- 1 root root 124 2005-04-19 21:05 dirmngr
-rw-r--r-- 1 root root 170 2005-05-27 10:10 exim4-base
-rw-r--r-- 1 root root 94 2005-05-05 19:32 ppp
-rw-r--r-- 1 root root 68 2005-04-17 12:00 scrollkeeper
-rw-r--r-- 1 root root 301 2005-05-30 00:30 squid

kind regards
chris

[Stuart Browne · Accepted solution]

Hrm, I'm not 100% sure where Debian sets all the logrotate rules, but it'll either be in '/etc/logrotate.d' (as you've already seen) or in '/etc/logrotate.conf'.

If you look in '/etc/logrotate.conf', you should see entries which start with the keyword 'include'. These are the directories Logrotate will search for configuration.

Log file rotation entires can also be set in the conf file.

When you do find your syslog entries, you need to change the 'rotate' value to something smaller for the affected logs (i.e. to 1). This will allow you to keep one weeks worth of compressed logs.

['chris']

my logrotate.conf looks:

# vi /etc/logrotate.conf
-----------------------------------------------------------------
# see "man logrotate" for details
# rotate log files weekly
weekly

# keep 4 weeks worth of backlogs
rotate 4

# create new (empty) log files after rotating old ones
create

# uncomment this if you want your log files compressed
#compress

# packages drop log rotation information into this directory
include /etc/logrotate.d

# no packages own wtmp, or btmp -- we'll rotate them here
/var/log/wtmp {
missingok
monthly
create 0664 root utmp
rotate 1
}

/var/log/btmp {
missingok
monthly
create 0664 root utmp
rotate 1
}

# system-specific logs may be configured here
-----------------------------------------------------------------

you mean to change:
-----------------------------------------------------------------
# keep 4 weeks worth of backlogs
rotate 4
-----------------------------------------------------------------
to

rotate 1 ?

[Eknath]

Hi Chris,

write a small script which includes find command(see man pages of find). Get a list of older syslog files and compress them or delete them. schedule this script in cron.

Cheers!!!
eknath

[Stuart Browne]

Well, not in there. Did you 'grep syslog /etc/logrotate.d/*' ?

My guess would be that it's in 'base-config' since it's not directly in the .conf file.

[Vitaly Karasik_1]

Chris, for you system deletes logs after 4 weeks, you may replace it to "1".

[Gopi Sekar]

From your logrotate.conf

# keep 4 weeks worth of backlogs
rotate 4

which means it will keep 4 weeks of log files, just reduce it to 1 and it will keep only one week of log files.

you can also change the weekly to daily so that your log files will get archived daily and more than 1 week file (set rotate 7) will get purged

Hope this helps,
Gopi