2012-06-05

Wildcards in `logrotate` configuration

One of the most painful mistakes you can do in logrotate configuration is:

/var/log/foo/* { daily rotate 3 }

Looks fine? You may expect the result of logrotate run to be something like

$ ls /var/log/foo/ foo.log <-- Friday foo.log.1 <-- Thursday foo.log.2 foo.log.3 <-- Tuesday # Monday log deleted


with foo.log.N file emerging daily, and older files deleted automatically.

But what will actually happen is, well, exactly as written, all the logs in the directory will get rotated every time, including .N-files:

$ ls /var/log/foo/ foo.log <-- Friday foo.log.1 <-- Thursday foo.log.1.1 foo.log.1.1.1 <-- Tuesday foo.log.1.1.1.1 <-- Monday log is still there foo.log.1.1...1.1 <-- I am from the last year foo.log.1.1......1.1 <-- I remember UNIX time started back in 1970 ...


-- nice Christmas tree. You could wait forever until .2 and later files will be created and older files deleted but you'll most probably run out of disk space before that happens.

All good boys and girls do

/var/log/foo/*.log { daily rotate 3 }

instead (and use delaycompress option).

Funny thing, this case is explicitly described in logrotate man-page but sometimes you just (mostly mistakenly) feel so experienced with the tool that decide to skip the man-page -- well, they have nothing to surprise you with, right?

1 comment:

Ramki said...

hi ,

how to create logrotation file , if we have daily a new file name, like given below.

touch -t 201505261024 a.log
touch -t 201505251024 ab.log
touch -t 201505241024 abc.log
touch -t 201505231024 abcd.log
touch -t 201505221024 abcde.log
touch -t 201505201024 abcdef.log

my "test" logrotate file :

cat /etc/logrotate.d/test
/var/log/test/*.log {
daily
rotate 3
maxage 3
missingok
}


its not working ;-(

[root@sprintlab088vm2 test]# ll
total 0
-rw-r--r-- 1 root root 0 May 20 10:24 abcdef.log
-rw-r--r-- 1 root root 0 May 22 10:24 abcde.log
-rw-r--r-- 1 root root 0 May 23 10:24 abcd.log
-rw-r--r-- 1 root root 0 May 24 10:24 abc.log
-rw-r--r-- 1 root root 0 May 25 10:24 ab.log
-rw-r--r-- 1 root root 0 May 26 10:24 a.log

logrotate -f /etc/logrotate.d/test

[root@sprintlab088vm2 test]# ll
total 0
-rw-r--r-- 1 root root 0 May 20 10:24 abcdef.log.1
-rw-r--r-- 1 root root 0 May 22 10:24 abcde.log.1
-rw-r--r-- 1 root root 0 May 23 10:24 abcd.log.1
-rw-r--r-- 1 root root 0 May 24 10:24 abc.log.1
-rw-r--r-- 1 root root 0 May 25 10:24 ab.log.1
-rw-r--r-- 1 root root 0 May 26 10:24 a.log.1