logrotate question/problem

[joseph wholey]

I rotate my logs daily, but am having a problem with my maillog growing too large. It does not seem to be adhering to the parameters set in /etc/logrotate.conf. Here is what I have in /etc/logrotate.conf. I expect to keep 4 versions of any log and don't expect the log to grow greater than 100M at any time. Below is my /etc/logrotate.conf. Shouldn't "size 100M" do what I expect. i.e. rotate the logs when it hits 100M. /var/log/maillog is defined in /etc/logrotate.d/syslog. What am I missing?

# see "man logrotate" for details
# rotate log files weekly
#weekly

# commented out weekly and changed to size due to e-mail errors
size 100M

# keep 4 weeks worth of backlogs
rotate 4

# create new (empty) log files after rotating old ones
create

# uncomment this if you want your log files compressed
#compress

# RPM packages drop log rotation information into this directory
include /etc/logrotate.d

# no packages own wtmp -- we'll rotate them here
/var/log/wtmp {
monthly
create 0664 root utmp
rotate 1
}

[Rick Garland]

Place the "size 100M" statement in the stanza specific to maillog in the '/etc/logrotate.d'

[joseph wholey]

Rick,
I don't have a specific file/stanza for mail in my /etc/logrotate.d directory. /var/log/maillog is included in /etc/logrotate.d/syslog. Shouldn't that be enough?
I can't seem to find any documentation on how logs specified in the /etc/logrotate.d/syslog are treated. thx. -joe-

[Ivan Ferreira]

Are you sure is rotating in daily basis? Because I don't see the "daily" option in your configuration file.

[joseph wholey]

Ivan,

Correct me if I'm wrong... and I very well could be... but I thought it went as follows:

1. start crond
2. crond searches /etc/crontab and /etc/cron.d for programs to run.
3. run-parts in root's crontab executes cron.daily/hourly/weekly etc...
4. logrotate runs out of /etc/cron.daily
5. /etc/logrotate.conf is read by /etc/cron.daily/logrotate
6. /etc/logrotate.conf includes files that are in /etc/logrotate.d directory
7. /etc/logrotate.d/syslog specifies /var/log/maillog

...so I'm pretty sure it is running? + this is from my /var/lib/rotate.status.

"/var/log/maillog" 2006-6-26

thx. joe

[Ivan Ferreira]

I think that the exact process will be:

1. start crond
2. crond searches /etc/crontab and /etc/cron.d for programs to run.
3. run-parts in root's crontab executes cron.daily/hourly/weekly etc...
4. logrotate runs out of /etc/cron.daily
5. /etc/logrotate.conf is read by /etc/cron.daily/logrotate
6. /etc/logrotate.conf includes files that are in /etc/logrotate.d directory
7. /etc/logrotate.d/syslog specifies /var/log/maillog
***8. If the logrotate.conf is configured to be executed in daily basis with the daily parameter, or if there are some log files configured to be rotated daily, then continues, if not, waits until the next run.

Anyway, you can use logrotate -f to "force" and test the rotation of the log files. Also, consider that the files may grow beyond the 100 MB because logrotate runs only once at the day, and won't monitor the file so when exactly 100 MB is reached will be rotated.

[Steven E. Protter]

Shalom,

Based on a thorough reading of the thread, I'd suggest changing the cron schedule for logrotate.

If 100 MB is important to you than run logrotate more often. All its going to do is nothing if the parameters are not met.

We like to run it on a fixed schedule so we know the time span of log contents. Its not like its from Mount Sinai or anything, you can do what you want.

SEP

[Stuart Browne]

We rotate our mail log every hour (outside of logrotate though, as it doesn't like hourly), and keep about a months worth.

I agreep with SEP though.

If the 100MB is important, then run logrotate more regularly than once-a-day. 'logrotate' will handle the logs correctly, as it keeps it's own records as to when it's rotated something.

[joseph wholey]

Ok... still haven't received a satisfactory explanation as to why the 100MB is not being honored... but, I'm putting logrotate into /etc/cron.hourly to circumvent.

[Ivan Ferreira]

Remember to use the -f option or logrotate wont run two times the same day.