Logrotate: rotate all log files on specific size and rotate hourly

Question

My logrotate file on ubuntu runs daily. I want to make sure its rotating log files in every hour to get no full disk error anymore. So my logrotate file is in the cron.daily folder, is it enough to simply move it to cron.hourly?

I also want to keep my max log file size on 5MB, but Im not sure what to change in the logrotate.cnf.

logrotate.cnf content (without line breaks):

weekly rotate 4 create include /etc/logrotate.d

/var/log/wtmp { missingok monthly create 0664 root utmp rotate 1 }

/var/log/btmp { missingok monthly create 0660 root utmp rotate 1 }

I know I have to use size 5M, but where should I write it? Am I thinking good that the first line is for all log files and the second and third is for only wtmp and btmp? So if my logic is correct then I have to write size 5M in all line, am I right?

Answer 1

In order for it to have any effect, the cron script must be run at least as often as you want to rotate the files. Even though you are currently running the script once a day (from cron.daily), it will only change the files once a week (the weekly keyword in the logrotate script sets the default, this is overriden to monthly in the case of wtmp and btmp).

The version of logrotate on my nearest Linux box only does down to daily duration (although setting a size limit will force files to be rotated more frequently). Having said that, for most servers, log rotation is disruptive; if your objective is to conserve space then it might be more approriate to keep fewer history files and to compress them:

daily rotate 2 compress size 5M create include /etc/logrotate.d

/var/log/wtmp { missingok monthly create 0664 root utmp rotate 1 }
/var/log/btmp { missingok monthly create 0660 root utmp rotate 1 }

(Note the changes in the first line will have no effect if they are overridden elsewhere.)

Answer 2

A non elegant way that worked for me - run logrotate hourly based on file size do the following ;

1) Copy the Logrotate script from cron.daily folder to cron.hourly folder

cp /etc/cron.daily/logrotate   /etc/cron.hourly/ 

2) Update the /etc/cron.hourly/logrotate file ; comment and replace the last line as follows

#/usr/sbin/logrotate /etc/logrotate.conf
/usr/sbin/logrotate  /etc/logrotate.d/logstash 

3) update the relevant /etc/crontab entry as follows (if required)

#17 *   * * *   root    cd / && run-parts --report /etc/cron.hourly
59 *    * * *   root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.hourly )

4) Finally write the following logic in your logrotate conf file (update folder paths and size as per your requirement)

 cat /etc/logrotate.d/logstash
    /var/log/logstash/*.log /var/log/logstash/*.err  {
    hourly
    size 10M
    rotate 4
    copytruncate
    compress
    #delaycompress
    missingok
    notifempty }