can I use logrotate to rotate /core files?

Question

On remote linux-based devices, I thought I'd use logrotate to manage any core files our appliance may create. But it seems logrotate considers every core file a unique file since the filename includes the PID. This breaks the way logrotate normally rotates files. E.g.:

core_123
core_222
core_555

Instead of seeing these as 3 variations of the same file, it sees this as 3 unique files. So if I had rotate 50 in /etc/logrotate.d/core, it would be willing to rotate through 50 different core_123 files, and 50 different core_222 files, etc., resulting in potentially hundreds or thousands of files. Instead, I want to ensure that logrotate manages a maximum of 50 core_* files.

This is the exact logrotate file I was trying to make work:

/mycores/core_* {
    compress
    daily
    maxage 28
    missingok
    nocreate
    nodelaycompress
    olddir /mycores/old
    rotate 50
}

I suspect this isn't possible with logrotate, but I figured I'd post on serverfault just in case I missed something in the documentation.

Answer 1

We use a script like this. I don't see the point of involving logrotate as

1. these are not log files
2. you are not rotating them

script:

#!/bin/bash
EMAIL_TO="<%= mail %>"
EMAIL_SUBJ="Found core files on `hostname -s`"
DATETIME=`date +"%F-%H%M%S"`
EMPTY_CORE_FILES=`find /var/log/core/ -mmin +60 -type f -empty -not -name "*.gz" -not -name "*.zip" -print -exec rm {} \;`
CORE_FILES=`find /var/log/core/ -mmin +60 -type f -not -empty -not -name "*.gz" -not -name "*.zip"`
NUM_CORE_FILES=`echo $CORE_FILES | wc -w`

lockfile="/tmp/`basename $0`.lock"
lockfile -1 -r 5 -l 84600 ${lockfile} || exit 1
trap "/bin/rm -f $lockfile" EXIT INT TERM

for f in $CORE_FILES;
do
  gzip -9 $f
done

if [ $NUM_CORE_FILES != 0 ]
then

  mail "$EMAIL_TO" -s "$EMAIL_SUBJ" <<EOF
I found and gzipped $NUM_CORE_FILES on $HOSTNAME in /var/log/core, please investigate.

Files Found:
$CORE_FILES

Empty Files:
$EMPTY_CORE_FILES

EOF

fi

Answer 2

I combined logrotate with some shell magic to get the desired effect. Basically logrotate is still in charge of moving and compressing the files, and then kicking off the script needed to delete the old files as well as ensuring the directory doesn't have more than 50 or so files. Here is what I did:

/mycores/core_* {
    compress
    daily
    missingok
    nocreate
    nodelaycompress
    olddir /mycores/old
    sharedscripts
    postrotate
        # delete all core_*.gz files older than 28 days
        find /mycores/old -name "core_*.gz" -mtime +28 -delete
        # make sure we have a max of 50 files; delete the oldest files if we have too many
        for filename in $(find /mycores/old/ -name "core_*.gz" -printf "%T+ %p\n" | sort --reverse | tail --lines=+51 | cut -d' ' -f2); do rm $filename; sleep 0.5; done
    endscript
}

I'm not the best bash scripter out there, so that postrotate script section might be heavier than necessary... :)