My server dumps because of huge system log files. I've heard that we could limit the size of system log by adding such a line size 100m
into the file /etc/logrotate.d/rsyslog
to do so.
Now my /etc/logrotate.d/rsyslog
becomes as below:
/var/log/syslog
{
rotate 7
daily
size 100m
missingok
notifempty
delaycompress
compress
postrotate
invoke-rc.d rsyslog rotate > /dev/null
endscript
}
My question is: how does size 100m
work with rotate 7
?
Without size 100m
, rotate 7
and daily
together mean that the system log will be rotated daily and it will keep 7 days worth of backlogs. Now if I add size 100m
and some daily log is bigger than 100m
, will it rotate immediately? If so, does it mean that I may get 7 backlogs in a day if some daily log grows too much (more than 700mb
)?
I hope you realize that your using the
logrotate
mechanism does NOT control the size of the syslog file, it only will each day whenever logrotate is run, take the current/var/log/syslog
file and if it is over 100MBytes, compress and save the result. A new/var/log/syslog
file is then created which starts receiving messages from that point forward.