Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm stumped with this one. Any help is much appreciated...!

Logs in /var/log/HOSTS/cacheflow_access_log/ are configured to archive to /var/log/HOSTS/archived/cacheflow_access_log/ and compress. These are pretty big files so should only be kept for 1 day so that Splunk or Sawmill can summarize their content.

The logs rotate and compress without issue, but the old compressed logs are not deleted. The verbose output of logrotate suggests this is an issue with glob. Is it looking in the live directory rather than the archive directory? If so, how can I fix this? If not, WTF is going on?!

Logrotate conf:

# logrotate configuration for syslog files

# global options
   rotate 1
   missingok
   daily
   compress
   ifempty
   dateformat -%Y%m%d
   dateext

---SNIP---

/var/log/HOSTS/cacheflow_access_log/* {
   daily
   # only keep 1 day of cacheflow as they're massive files
   maxage 1
   rotate 1
   olddir /var/log/HOSTS/archived/cacheflow_access_log
   postrotate
      invoke-rc.d proftpd restart 2>/dev/null >/dev/null || true
   endscript
}

Logrotate verbose output:

considering log /var/log/HOSTS/cacheflow_access_log/CF_5000_20120803_092129.log
log needs rotating
rotating log /var/log/HOSTS/cacheflow_access_log/CF_5000_20120802_120326.log, log >rotateCount is 1
Converted ' -%Y%m%d' -> '-%Y%m%d'
dateext suffix '-20120803'
glob pattern '-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]'
glob finding old rotated logs failed
renaming /var/log/HOSTS/cacheflow_access_log/CF_5000_20120802_120326.log to /var/log/HOSTS/archived/cacheflow_access_log/CF_5000_20120802_120326.log-20120803
running postrotate script

Running Debian Squeeze 2.6.32-5-686-bigmem

I know that there are unnecessary duplications in that config (e.g. rotate 1 doesn't need to be reiterated) - it was just to ensure that wasn't the issue causing this problem.

Thanks!

share|improve this question
add comment

1 Answer

Perhaps it is failing because the log file already has the date in the name, and so it is a new name each day. Typically I see log files with a static name, and logrotate adds an extension to make them unique. logrotate may be looking for old files in the archive directory with a name of CF_5000_20120802_120326.log to delete them. It doesn't find any because the base name of each file is unique.

share|improve this answer
    
I follow your thinking - thanks for the idea - but it also seems to be failing with the other archive subdirectories, e.g. /var/log/HOSTS/archived/local3 contains my switch syslogs and logrotate isn't deleting old files there either, e.g. 10.160.8.33-20120801.gz (the 20120801 will have been appended by logrotate). In the words of Catchphrase host Roy Walker, it's good, but it's not the one...! –  James Aug 3 '12 at 4:46
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.