38

Judging by the timestamps on my systems, logrotate does its daily log rotation when logrotate is run by cron. However, if I run it earlier than that it doesn't rotate the files. How does logrotate know if should rotate them or not, does it keep a history or perhaps use timestamps?

3 Answers 3

40

I believe it's the content of the state file, which is my case is /var/lib/logrotate.status. Each file has one line, which is the date on which it was last rotated; if you run logrotate on such a date that a given file is due for rotation, given the number of days between current date and the date in the file (1 for daily, 7 for weekly, etc.), the file will be rotated.

logrotate doesn't seem to care at what time of day it's run; even if it usually runs at 2355, if you were to run it at 0130 instead, it would still rotate files marked daily and last done yesterday; but having done so it would put today's date into the state file (against any rotated files), so a second run at 2355 would do nothing.

6
  • 4
    Hmm.. So it only rotates if: current date > date in /var/lib/logrotate/status (as the file is in my case). Nov 4, 2010 at 14:28
  • 3
    I think it only does anything at all if 24 hours have passed since it was last run, which it works out by examining the mtime of the state file. Once it's decided a whole day has passed and it may lawfully do anything at all, it makes DAILY, WEEKLY etc. decisions based on the date fields inside the file.
    – MadHatter
    Nov 4, 2010 at 14:30
  • 5
    Well it seems to use the date in that file. I set the day one day back in the status file and ran it ... it rotated .. Nov 4, 2010 at 14:48
  • 1
    Having just gone back and poked my logrotate, I think I was wrong and what you write above is right. It decides if it's already been run today by looking at the timestamp of the state file; if it hasn't, it proceeds to extract the dates of last rotation from the state file, and acts accordingly. I just lied to logrotate with vi and touch -t to persuade it that it last ran at 2355 yesterday, when it rotated my munin logs. Running it again, even though it's been less than 24 hours, it rotated them out and updated the state file accordingly.
    – MadHatter
    Nov 4, 2010 at 14:50
  • I've updated my answer to my current understanding, given the set of tests I've just run (slicing my munin logs eight ways from sunday, but who cares!).
    – MadHatter
    Nov 4, 2010 at 14:57
12

From the logrotate man page:

Normally, logrotate is run as a daily cron job. It will not modify a log more than once in one day unless the criterion for that log is based on the log's size and logrotate is being run more than once each day, or unless the -f or -force option is used.

1
2

It runs on crontab schedules. You just need to find which crontab schedule has logrotate configured. Normally, it's in the daily /etc/cron.daily/. The generic crontab schedules are available in /etc/crontab.

Sample below:

# run-parts
01 * * * * root run-parts /etc/cron.hourly
02 4 * * * root run-parts /etc/cron.daily
22 4 * * 0 root run-parts /etc/cron.weekly
42 4 1 * * root run-parts /etc/cron.monthly```
1
  • What command did you type to get this output "Sample below" ?
    – SebMa
    Sep 6, 2022 at 13:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .