I'm stumped with this one. Any help is much appreciated...!
Logs in /var/log/HOSTS/cacheflow_access_log/ are configured to archive to /var/log/HOSTS/archived/cacheflow_access_log/ and compress. These are pretty big files so should only be kept for 1 day so that Splunk or Sawmill can summarize their content.
The logs rotate and compress without issue, but the old compressed logs are not deleted. The verbose output of logrotate suggests this is an issue with glob. Is it looking in the live directory rather than the archive directory? If so, how can I fix this? If not, WTF is going on?!
Logrotate conf:
# logrotate configuration for syslog files
# global options
rotate 1
missingok
daily
compress
ifempty
dateformat -%Y%m%d
dateext
---SNIP---
/var/log/HOSTS/cacheflow_access_log/* {
daily
# only keep 1 day of cacheflow as they're massive files
maxage 1
rotate 1
olddir /var/log/HOSTS/archived/cacheflow_access_log
postrotate
invoke-rc.d proftpd restart 2>/dev/null >/dev/null || true
endscript
}
Logrotate verbose output:
considering log /var/log/HOSTS/cacheflow_access_log/CF_5000_20120803_092129.log
log needs rotating
rotating log /var/log/HOSTS/cacheflow_access_log/CF_5000_20120802_120326.log, log >rotateCount is 1
Converted ' -%Y%m%d' -> '-%Y%m%d'
dateext suffix '-20120803'
glob pattern '-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]'
glob finding old rotated logs failed
renaming /var/log/HOSTS/cacheflow_access_log/CF_5000_20120802_120326.log to /var/log/HOSTS/archived/cacheflow_access_log/CF_5000_20120802_120326.log-20120803
running postrotate script
Running Debian Squeeze 2.6.32-5-686-bigmem
I know that there are unnecessary duplications in that config (e.g. rotate 1 doesn't need to be reiterated) - it was just to ensure that wasn't the issue causing this problem.
Thanks!
postrotate
script would clean it up. First test if more than 1 file exists. If so, delete oldest. Something like: stackoverflow.com/a/47593062/503621find /var/log/HOSTS/archived/ -type f -printf '%T@\t%p\n' | sort -t $'\t' -g | head -n1 | cut -d $'\t' -f 2- | xargs rm
(Note - Not tested.) Really should use a full script, though. This doesn't test if there is only 1 file - would remove it. – bshea Oct 6 '19 at 18:01olddir
is 'cleaned' by logrotate by itself. I think they leave that up to you. If I missed that info in docs let me know. – bshea Oct 6 '19 at 18:04