Home / server / Questions / 1070904
Accepted
justanotheruser1019
Asked: 2021-07-29 05:29:00 +0800 CST

Limit number of available archives in syslog rotation

  • 772

I have the following configuration for my /etc/logrotate.d/rsyslog file. In it, i explicitly declared the number of days it will rotate to 4 and the size of the rotation archive file as 100k for /var/log/syslog.

What I want to know is when the archive reaches 100k it should rotate itself. Does it rotate up to 4 times total within a day if need be? If it needs to rotate 4 times because it continuously reaches 100k it will do so and only hold 4 files? Maybe I'm not able to fully explain my question, but the goal I'm looking for is once the rotated archive file reaches 100k, it should rotate itself and the total number of rotations should not pass 4 files So, if it needed 8 rotations in an hours span, there should be the last 4 rotated archives only. I do see a daily configuration, not sure if that is complemented with the rotate configuration?

If i need to set a maximum number of archive files, and the day rotation configuration isnt doing that, what do i need to do?

/var/log/syslog
{
        rotate 4
        size 100k
        daily
        missingok
        notifempty
        delaycompress
        compress
        postrotate
          invoke-rc.d rsyslog rotate >/dev/null
        endscript
}

/var/log/mail.info
/var/log/mail.warn
/var/log/mail.err
/var/log/mail.log
/var/log/daemon.log
/var/log/kern.log
/var/log/auth.log
/var/log/user.log
/var/log/lpr.log
/var/log/cron.log
/var/log/rsyslog.log
/var/log/debug
/var/log/messages
{
        rotate 4
        weekly
        missingok
        notifempty
        compress
        delaycompress
        sharedscripts
        postrotate
          invoke-rc.d rsyslog rotate >/dev/null
        endscript
}

I also have this syslog configuration which limits syslog file size to 1MB. So when syslog reached 1MB it should rotates itself (untested yet)

auth,authpriv.*    -/var/log/auth.log
$outchannel mysyslog,/var/log/syslog,1048576
*.*;auth,authpriv.none  :omfile:$mysyslog
syslog rsyslog

1 Answers

  1. Best Answer

    logrotate will not trigger a rotation when a file reaches "size 100k" It operates by scheduled checks.

    Explaining how the first section of your config would work. Perform a daily check of /var/log/syslog, if it is larger than 100k rotate it, if there are 4 copies remove the earliest.

    You could change daily to hourly in the config file. Then, cp /etc/cron.daily/logrotate /etc/cron.hourly/logrotate if it is not there already.

    • 1