20

From the man page of logrotate:

minsize size
Log files are rotated when they grow bigger than size bytes, but not before the additionally specified time interval (daily, weekly, monthly, or yearly). The related size option is similar except that it is mutually exclusive with the time interval options, and it causes log files to be rotated without regard for the last rotation time. When minsize is used, both the size and timestamp of a log file are considered.

size size
Log files are rotated when they grow bigger than size bytes. If size is followed by k, the size is assumed to be in kilobytes. If the M is used, the size is in megabytes, and if G is used, the size is in gigabytes. So size 100, size 100k, size 100M and size 100Gare all valid.

I set size as 5M and interval as weekly thinking that the logs would get rotated on a weekly basis and additional rotation would occur if the size of the log exceeds 5M. But what happens is that the log does not get rotated unless it exceeds 5M, which seems to be what minsize is supposed to do.

Am I interpreting the manual wrongly? How do I get the log to rotate on a weekly basis AND if it exceeds 5M?

EDIT:

I am not sure whether the following information is relevant, but just to supplement:

I am using rsyslog to do the main logging for messages, secure, cron, maillog, boot. The following are the rotation date and file size of the penultimate logs where size and interval are set as described above:

filename  rotation date  file size
messages  20130129       5.3MB
secure    20130113       5.1kB
cron      20130113       3.6kB
maillog   20130113       1.1kB

As can be seen, only messages get rotated.

EDIT2:

I should have check with man logrotate. They actually upgraded it with the maxsize option. This should be what I am looking for:

maxsize size
Log files are rotated when they grow bigger than size bytes even before the additionally specified time interval (daily, weekly, monthly, or yearly). The related size option is similar except that it is mutually exclusive with the time interval options, and it causes log files to be rotated without regard for the last rotation time. When maxsize is used, both the size and timestamp of a log file are considered.

23

Some questions are answered here: logrotate daily and size?

Typically logrotate will only be run once daily, so the size limits will not be honoured exactly. logrotate's status file (possibly /var/lib/logrotate.status) only stores dates (not times), it is not intended for use more frequently, so you cannot trivially rotate files more frequently (Update: version 3.85 adds hourly support, and stores a complete timestamp in the state file.)

You don't say which syslogd you're using, rsyslog and syslog-ng support self-managed size based rotation, so you should be able to get those to rotate by size, and get logrotate to rotate weekly (though some thought might be required for file naming to make sure simultaneous file rotation doesn't accidentally delete something).

One other option is to use piped logs, just like Apache, in fact Apache-2.4's rotatelogs supports exactly this feature (previous versions only supported size or time independently). You don't say where the logs are originating from, but you might be able to log to a pipe or fifo, and use rotatelogs, if that's supported.

With logrotate <= v3.8.0 the three supported scenarios are:

  1. size rotate by size, once daily at most, regardless of elapsed timeperiod
  2. timeperiod rotate unconditionally by timeperiod, regardless of size
  3. minsize & timeperiod if logfile size exceed minsize, then rotate by timeperiod. A common use is "minsize 1" which means 0-byte logs don't get rotated, minimising clutter.

logrotate-3.8.1 adds:

  1. maxsize & timeperiod rotate when either size exceeds maxsize, or after elapsed timeperiod. logrotate may need to be run more than the default once per day in this case.

logrotate-3.8.5 adds:

  1. hourly support, and stores a complete timestamp in the state file. You should run logrotate (at least) hourly for this.
  • Please see my update, thanks for the link. Seems like some scripting is required? minsize seems not very useful, I wonder why they have it instead of maxsize. – Question Overflow Feb 3 '13 at 15:22
  • 1
    Yay, the maxsize option is now available. Case close :) – Question Overflow Feb 3 '13 at 15:38
  • spotted that in the docs before I read your update... answer now expanded. thx. – mr.spuratic Feb 3 '13 at 16:13
  • 1
    > logrotate's status file (possibly /var/lib/logrotate.status) only stores dates (not times) This statement may be out of date. I just checked my logrotate status file, and it contained timestamps with second resolution: "/var/log/kern.log" 2018-3-12-1:8:16 – hyperair Mar 13 '18 at 7:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.