Score:1

Rotation not executing when file size reaches certain threshold

us flag

I have the following configurations in /etc/logrotate.d/rsyslog:

/var/log/syslog
{
        rotate 7
        size 1G
        missingok
        notifempty
        delaycompress
        compress
        postrotate
          invoke-rc.d rsyslog rotate >/dev/null
        endscript
}

From what I understand, I've set it up so if /var/log/syslog reaches 1G in size, it will rotate itself. Also, the system will hold 7 rotations.

In testing, I did this:

cat /dev/null > /var/log/syslog
base64 /dev/urandom | head -c 999999999 > /var/log/syslog
logger -s "hello"

Then I did this:

ls -las /var/log/syslog*
976568 -rw-r----- 1 syslog adm 1000000072 Jul 28 19:11 /var/log/syslog

It's showing the file size as 1.000000728 GB shouldn't it have rotated itself?

When applying the configurations, I did systemctl restart rsyslog

Score:1
cz flag

Logrotate uses traditional units rather than SI units for K, M, G, etc. This means literally, quoting from the source code: 1024 * 1024 * 1024, or 1073741824 bytes.

justanotheruser1019 avatar
us flag
so i just need to declare it as `size 1073741824` correct?
Michael Hampton avatar
cz flag
@jk22721019 You already did! What you need to do is write more data to the log file.
justanotheruser1019 avatar
us flag
Oh i see. lol haha
justanotheruser1019 avatar
us flag
i did `logger -s "hello"` and now the size says `1073741883` for `ls -las /var/log/syslog` and no rotated logs...
justanotheruser1019 avatar
us flag
i do see this... Jul 28 19:37:43 rsyslogd: unknown priority name "" [v8.1901.0] Jul 28 19:37:43 rsyslogd: imfile: no files configured to be monitored - no input will be gathered [v8.1901.0 try https://www.rsyslog.com/e/2212 ]
Michael Hampton avatar
cz flag
@jk22721019 You know logrotate only runs nightly, right?
justanotheruser1019 avatar
us flag
Oh. I see. So maybe i need to adjust the cron job to run every few minutes then, so it can pick up a syslog greater than a certain size correct and run the logrotate instead of waiting until night?
justanotheruser1019 avatar
us flag
i thought by removing `hourly` or `daily` it would respond immediately. apparently not.
Michael Hampton avatar
cz flag
@jk22721019 You can certainly do that, but if you're really generating such enormous amounts of logs in reality then you should seriously consider (1) whether the logs are actually necessary, and (2) some other approach to storing them. Anyway, this has gotten far away from your question.
justanotheruser1019 avatar
us flag
I appreciate the help. The only issue i have now is when i execute manually for testing purposes `sudo /etc/cron.daily/logrotate` it rotates perfectly but i cannot log any data to the new syslog file. i ammended to the logrotate script `chown syslog:adm syslog` and that is being finicky - it seems to allow writing after a minute or two of creation. Any ideas?
mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.