2

How can I specify output file size which I want after rotation? For example lets say I want to run logrotate when log file reaches 10MB and I want to split this log into chunks which are 1MB max. I have found options "size" but this sets limit above which logrotate is run and not the size of desired chunk. Thanks

1 Answer 1

6

logrotate by itself doesn't support the splitting of the rotated log/s, only compression.

You may be able to get the desired behaviour by writing a script of your own that handles the splitting, and call that as a postrotate script in your logrotate configuration for that particular file/s.

update: based on your comment ("it is too late to split files, because they will be splitted by logrotate"), it seems you still have the idea that logrotate is doing splitting of files. This isn't correct, what actually happens is that logrotate renames the existing file and creates a new empty file with the original name.

An example:

/var/log/syslog
{
        rotate 7
        daily
        missingok
        notifempty
        delaycompress
        compress
        postrotate
                reload rsyslog >/dev/null 2>&1 || true
        endscript
}

When logrotate runs:

  • it renames /var/log/syslog to /var/log/syslog.1
  • it then creates a new empty file /var/log/syslog.
  • renaming a file has no effect on any processes that had an open file handle, so after doing this, the rsyslog process is still writing to the old file, syslog.0. Typically, the way to get around this is to reload the process/es that write to the file, which is what happens in the postrotate script. rsyslog is told to reload, it closes its existing file handle to /var/log/syslog.0, and opens a new file handle using the filename /var/log/syslog, the new empty file created by logrotate.

Hopefully you have a better understanding of what logrotate is doing now.

update 2: I'll address your comments here, as formatting options in the comments section are limited.

So when I understand right in the post processing part it is necessary to reload rsyslog to enshure that old file descriptor (before rotation) will be closed and new file descriptor (after rotation) will be opened (because of: mv syslog syslog.1)?

100% correct. After logrotate moves the file, rsyslog is still writing to the old file descriptor. A process performs I/O on the file descriptor, the name is only of interest when performing the initial open on the file.

I thought that logrotate has some mechanism to achieve this automatically.

No, hence the need to do it in a postrotate script. Remember that not all logging is necessarily done by a process which keeps an open file descriptor. If you have a process which opens a file, writes to it and then closes (the file descriptor) repeatedly, then you needn't fuss with anything in the postrotate.

PS: Did you mean "syslog.0" not "syslog" in the following senetence: "the rsyslog process is still writing to the old file, syslog.0."? Becuse "old" log is /var/log/syslog not /var/log/syslog.0. Thank you

No. I mean that it's still writing to the existing file descriptor, which logrotate has renamed to syslog.0. When dealing with processes like rsyslog, always remember that the file name is only relevant at the point when rsyslog opens it, i.e. when it creates the file descriptor. After that you can rename, move, even delete the file, and the process continues performing I/O on the file descriptor unhindered.

9
  • I do not understand you well. How can I write postprocessing script which handles the splitting? I need to split files first and then compress them. When logrotate is done it is too late to split files, because they will be splitted by logrotate. Or am I missing something, what is the basic idea of logrotate? It just compress files after they reaches specific size and renames them to {file}.0.log (very basic overview)? I have read several tutorials about logrotate but now I am a little bit confused. Jun 7, 2013 at 12:46
  • I updated my answer with some more info, hope it clears up the confusion. Jun 7, 2013 at 13:17
  • So if I understand right in the post processing part it is necessary to reload rsyslog to enshure that old file descriptor (before rotation) will be closed and new file descriptor (after rotation) will be opened (because of syslog was moved to syslog.1 and syslog was created and thus is in fact new file)? I thought that logrotate has some mechanism to achieve this automatically. PS: Did you mean "syslog.0" not "syslog" in the following senetence: "the rsyslog process is still writing to the old file, syslog.0."? Becuse "old" log is /var/log/syslog not /var/log/syslog.0. Thank you Jun 13, 2013 at 15:53
  • One more note: is it safe to move file on which is opened file descroptor? In unix terminology I hope that logrotate did not do "mv syslog syslog.0 && touch syslog" but rather "cat syslog > syslog.0 && echo > syslog", is the reload of rsyslog needed in this case? Thank you Jun 13, 2013 at 15:54
  • One more question: Does logrotate somehow tracks the changes of the log so it is smart enought to know that if it was no change from last time logs was rotated there is no need to do it again? Jun 13, 2013 at 16:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .