This is my conf:
/var/log/apache2/*.log {
weekly
missingok
rotate 52
compress
delaycompress
notifempty
create 640 root adm
sharedscripts
postrotate
if /etc/init.d/apache2 status > /dev/null ; then \
/etc/init.d/apache2 reload > /dev/null; \
fi;
endscript
prerotate
if [ -d /etc/logrotate.d/httpd-prerotate ]; then \
run-parts /etc/logrotate.d/httpd-prerotate; \
fi; \
endscript
}
If I undertand correctly, it should hold 52 weeks of worth logs (packed), but they get deleted after every week instead.
I have 2 virtual hosts, one is www and the other one is test subdomain. This is how I tell my sites to be logged from sites-enabled conf.
<VirtualHost *:80>
ServerAdmin [email protected]
ServerName test.xxx.com
ServerAlias test.xxx.com
DocumentRoot /var/www/test.xxx.com/public_html
<Directory /var/www/test.xxx.com/public_html/>
Options Indexes FollowSymLinks
AllowOverride All
Require all granted
</Directory>
AddDefaultCharset UTF-8
ErrorLog ${APACHE_LOG_DIR}/test.xxx.com/error.log
CustomLog ${APACHE_LOG_DIR}/test.xxx.com/access.log combined
</VirtualHost>
Where xxx.com is my domain and test.xxx.com folder does exist in apache log dir. The logging works fine, but the old logs just dissapear!
I did: logrotate -f -d /var/log/apache2/xxx.com/access.log
as @Craig Miskell suggested.
The output I got was:
error: /var/log/apache2/xx.com/access.log:1 lines must begin with a keyword or a filename (possibly in double quotes)
error: /var/log/apache2/xxx.com/access.log:2 lines must begin with a keyword or a filename (possibly in double quotes)
error: /var/log/apache2/xxx.com/access.log:3 lines must begin with a keyword or a filename (possibly in double quotes)
error: /var/log/apache2/xxx.com/access.log:4 lines must begin with a keyword or a filename (possibly in double quotes)
etc...
I opened the log file and everything seems fine. I even used some software called Apache Logs Viewer (on Windows), this program also understands why log file very well.
Few first lines of the log file in question:
999.999.999.999 - - [26/Dec/2014:11:28:41 +0000] "GET /contact HTTP/1.1" 200 1622 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 OPR/26.0.1656.60"
999.999.999.999 - - [26/Dec/2014:11:31:01 +0000] "GET /contact HTTP/1.1" 200 1622 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 OPR/26.0.1656.60"
999.999.999.999 - - [26/Dec/2014:11:31:01 +0000] "GET /assets/css/normalize.css HTTP/1.1" 200 3034 "http://www.xxxxxx.com/contact" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 OPR/26.0.1656.60"
999.999.999.999 - - [26/Dec/2014:11:31:01 +0000] "GET /assets/css/skeleton.css HTTP/1.1" 200 4680 "http://www.xxxxxx.com/contact" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 OPR/26.0.1656.60"
999.999.999.999 - - [26/Dec/2014:11:31:01 +0000] "GET /assets/js/main.js HTTP/1.1" 200 1038 "http://www.xxxxxx.com/contact" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 OPR/26.0.1656.60"
999.999.999.999 - - [26/Dec/2014:11:31:01 +0000] "GET /assets/js/moment.js HTTP/1.1" 200 14752 "http://www.xxxxxx.com/contact" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 OPR/26.0.1656.60"
999.999.999.999 - - [26/Dec/2014:11:31:01 +0000] "GET /assets/images/logo-inverted.png HTTP/1.1" 200 1864 "http://www.xxxxxx.com/contact" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 OPR/26.0.1656.60"
999.999.999.999 - - [26/Dec/2014:11:31:01 +0000] "GET /assets/images/logo.png HTTP/1.1" 200 3681 "http://www.xxxxxx.com/contact" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 OPR/26.0.1656.60"
I changed some IP and domains but everything else is as it is...
Googling the problem it looks like the file is not in correct (unix?) format, but I'm not even the one who is writing the file or creating new one, how can I create it wrong?!
logrotate -f -d config-file
and notlogrotate -f -d log-file