Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

From the man page of logrotate:

minsize size
Log files are rotated when they grow bigger than size bytes, but not before the additionally specified time interval (daily, weekly, monthly, or yearly). The related size option is similar except that it is mutually exclusive with the time interval options, and it causes log files to be rotated without regard for the last rotation time. When minsize is used, both the size and timestamp of a log file are considered.

size size
Log files are rotated when they grow bigger than size bytes. If size is followed by k, the size is assumed to be in kilobytes. If the M is used, the size is in megabytes, and if G is used, the size is in gigabytes. So size 100, size 100k, size 100M and size 100Gare all valid.

I set size as 5M and interval as weekly thinking that the logs would get rotated on a weekly basis and additional rotation would occur if the size of the log exceeds 5M. But what happens is that the log does not get rotated unless it exceeds 5M, which seems to be what minsize is supposed to do.

Am I interpreting the manual wrongly? How do I get the log to rotate on a weekly basis AND if it exceeds 5M?

EDIT:

I am not sure whether the following information is relevant, but just to supplement:

I am using rsyslog to do the main logging for messages, secure, cron, maillog, boot. The following are the rotation date and file size of the penultimate logs where size and interval are set as described above:

filename  rotation date  file size
messages  20130129       5.3MB
secure    20130113       5.1kB
cron      20130113       3.6kB
maillog   20130113       1.1kB

As can be seen, only messages get rotated.

EDIT2:

I should have check with man logrotate. They actually upgraded it with the maxsize option. This should be what I am looking for:

maxsize size
Log files are rotated when they grow bigger than size bytes even before the additionally specified time interval (daily, weekly, monthly, or yearly). The related size option is similar except that it is mutually exclusive with the time interval options, and it causes log files to be rotated without regard for the last rotation time. When maxsize is used, both the size and timestamp of a log file are considered.

share|improve this question
add comment

1 Answer

up vote 9 down vote accepted

Some questions are answered here: logrotate daily and size?

Typically logrotate will only be run once daily, so the size limits will not be honoured exactly. logrotate's status file (possibly /var/lib/logrotate.status) only stores dates (not times), it is not intended for use more frequently, so you cannot trivially rotate files more frequently.

You don't say which syslogd you're using, rsyslog and syslog-ng support self-managed size based rotation, so you should be able to get those to rotate by size, and get logrotate to rotate weekly (though some thought might be required for file naming to make sure simultaneous file rotation doesn't accidentally delete something).

One other option is to use piped logs, just like Apache, in fact Apache-2.4's rotatelogs supports exactly this feature (previous versions only supported size or time independently). You don't say where the logs are originating from, but you might be able to log to a pipe or fifo, and use rotatelogs, if that's supported.

With logrotate <= v3.80 the three supported scenarios are:

  1. size rotate by size, once daily at most, regardless of elapsed timeperiod
  2. timeperiod rotate unconditionally by timeperiod, regardless of size
  3. minsize & timeperiod if logfile size exceed minsize, then rotate by timeperiod. A common use is "minsize 1" which means 0-byte logs don't get rotated, minimising clutter.

logrotate-3.81 adds:

  1. maxsize & timeperiod rotate when either size exceeds maxsize, or after elapsed timeperiod. logrotate may need to be run more than the default once per day in this case.
share|improve this answer
    
Please see my update, thanks for the link. Seems like some scripting is required? minsize seems not very useful, I wonder why they have it instead of maxsize. –  Question Overflow Feb 3 '13 at 15:22
    
Yay, the maxsize option is now available. Case close :) –  Question Overflow Feb 3 '13 at 15:38
    
spotted that in the docs before I read your update... answer now expanded. thx. –  mr.spuratic Feb 3 '13 at 16:13
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.