I am running rsyslog on CentOS and logrotate to rotate my logs. All hosts write their logs to /var/log/syslog/ in their own separate directory in this manner:
/var/log/syslog/host1
/var/log/syslog/host2
/var/log/syslog/host3
/var/log/syslog/host4
/var/log/syslog/host5
/var/log/syslog/host6
/var/log/syslog/host7
/var/log/syslog/host8
Under each of those directories is a file like 'host1.log' that needs to be rotated. The only problem is that I have two hosts whose logs are REALLY big (host3 and host7), and need to be rotated with a different retention schedule. I want to keep logs for 45 days on these two specific hosts, but all other hosts should be kept for 120 days. The problem is that they are alphabetical, and don't process correctly. I have tried creating separate policies like this, in my /etc/logrotate.conf file:
/var/log/syslog/host3/*.log {
daily
rotate 45
maxage 45
compress
dateext
dateyesterday
}
/var/log/syslog/host7/*.log {
daily
rotate 45
maxage 45
compress
dateext
dateyesterday
}
# Everything else
/var/log/syslog/*/*.log {
daily
rotate 120
maxage 120
compress
dateext
dateyesterday
}
When I run this, it rotates host3 and host7 at 45 days, like it's supposed to. Then when it gets to the /var/log/syslog//.log section, it only processes down to host3, then stops. So basically, host4, host5, host6, and host8 are never considered for rotation.
I have tried changing the order in the /etc/logrotate.conf file to put the "everything" rule at the top, like this:
# Everything else
/var/log/syslog/*/*.log {
daily
rotate 120
maxage 120
compress
dateext
dateyesterday
}
/var/log/syslog/host3/*.log {
daily
rotate 45
maxage 45
compress
dateext
dateyesterday
}
/var/log/syslog/host7/*.log {
daily
rotate 45
maxage 45
compress
dateext
dateyesterday
}
When I run it like that, it sets all my hosts to 120 day rotation using the first rule, then ignores my specific rules for host3 and host7. When it gets to those directories, it says:
rotating pattern: /var/log/syslog/host3/*.log after 1 days (45 rotations)
empty log files are rotated, old logs are removed
No logs found. Rotation not needed.
So, my question is, how do I setup my /etc/logrotate.conf file to allow for separate rules for separate directories? Is it even possible?