Join Log in
Score:0
justanotheruser1019 avatar Server

Limit number of available archives in syslog rotation

us flag
justanotheruser1019

I have the following configuration for my /etc/logrotate.d/rsyslog file. In it, i explicitly declared the number of days it will rotate to 4 and the size of the rotation archive file as 100k for /var/log/syslog.

What I want to know is when the archive reaches 100k it should rotate itself. Does it rotate up to 4 times total within a day if need be? If it needs to rotate 4 times because it continuously reaches 100k it will do so and only hold 4 files? Maybe I'm not able to fully explain my question, but the goal I'm looking for is once the rotated archive file reaches 100k, it should rotate itself and the total number of rotations should not pass 4 files So, if it needed 8 rotations in an hours span, there should be the last 4 rotated archives only. I do see a daily configuration, not sure if that is complemented with the rotate configuration?

If i need to set a maximum number of archive files, and the day rotation configuration isnt doing that, what do i need to do?

/var/log/syslog
{
        rotate 4
        size 100k
        daily
        missingok
        notifempty
        delaycompress
        compress
        postrotate
          invoke-rc.d rsyslog rotate >/dev/null
        endscript
}

/var/log/mail.info
/var/log/mail.warn
/var/log/mail.err
/var/log/mail.log
/var/log/daemon.log
/var/log/kern.log
/var/log/auth.log
/var/log/user.log
/var/log/lpr.log
/var/log/cron.log
/var/log/rsyslog.log
/var/log/debug
/var/log/messages
{
        rotate 4
        weekly
        missingok
        notifempty
        compress
        delaycompress
        sharedscripts
        postrotate
          invoke-rc.d rsyslog rotate >/dev/null
        endscript
}

I also have this syslog configuration which limits syslog file size to 1MB. So when syslog reached 1MB it should rotates itself (untested yet)

auth,authpriv.*    -/var/log/auth.log
$outchannel mysyslog,/var/log/syslog,1048576
*.*;auth,authpriv.none  :omfile:$mysyslog
92
1 + 1
djdomi avatar
za flag
djdomi
What sense should it make to rotate at `maxsize 100k` do you only have 10mb storage?
0
Reply
Score:1
ATP avatar Server
np flag
ATP

logrotate will not trigger a rotation when a file reaches "size 100k" It operates by scheduled checks.

Explaining how the first section of your config would work. Perform a daily check of /var/log/syslog, if it is larger than 100k rotate it, if there are 4 copies remove the earliest.

You could change daily to hourly in the config file. Then, cp /etc/cron.daily/logrotate /etc/cron.hourly/logrotate if it is not there already.

0 + 0
ธงชาติไทย
Elon Musk
I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.