logrotate not deleting old files - glob failing

Question

I'm stumped with this one. Any help is much appreciated...!

Logs in /var/log/HOSTS/cacheflow_access_log/ are configured to archive to /var/log/HOSTS/archived/cacheflow_access_log/ and compress. These are pretty big files so should only be kept for 1 day so that Splunk or Sawmill can summarize their content.

The logs rotate and compress without issue, but the old compressed logs are not deleted. The verbose output of logrotate suggests this is an issue with glob. Is it looking in the live directory rather than the archive directory? If so, how can I fix this? If not, WTF is going on?!

Logrotate conf:

# logrotate configuration for syslog files

# global options
   rotate 1
   missingok
   daily
   compress
   ifempty
   dateformat -%Y%m%d
   dateext

---SNIP---

/var/log/HOSTS/cacheflow_access_log/* {
   daily
   # only keep 1 day of cacheflow as they're massive files
   maxage 1
   rotate 1
   olddir /var/log/HOSTS/archived/cacheflow_access_log
   postrotate
      invoke-rc.d proftpd restart 2>/dev/null >/dev/null || true
   endscript
}

Logrotate verbose output:

considering log /var/log/HOSTS/cacheflow_access_log/CF_5000_20120803_092129.log
log needs rotating
rotating log /var/log/HOSTS/cacheflow_access_log/CF_5000_20120802_120326.log, log >rotateCount is 1
Converted ' -%Y%m%d' -> '-%Y%m%d'
dateext suffix '-20120803'
glob pattern '-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]'
glob finding old rotated logs failed
renaming /var/log/HOSTS/cacheflow_access_log/CF_5000_20120802_120326.log to /var/log/HOSTS/archived/cacheflow_access_log/CF_5000_20120802_120326.log-20120803
running postrotate script

Running Debian Squeeze 2.6.32-5-686-bigmem

I know that there are unnecessary duplications in that config (e.g. rotate 1 doesn't need to be reiterated) - it was just to ensure that wasn't the issue causing this problem.

Thanks!

Answer 1

Perhaps it is failing because the log file already has the date in the name, and so it is a new name each day. Typically I see log files with a static name, and logrotate adds an extension to make them unique. logrotate may be looking for old files in the archive directory with a name of CF_5000_20120802_120326.log to delete them. It doesn't find any because the base name of each file is unique.

Answer 2

For future readers, this line is in the logrotate.conf(5) docs:

Please use wildcards with caution. If you specify *, logrotate will rotate all files, including previously rotated ones. A way around this is to use the olddir directive or a more exact wildcard (such as *.log)