logrotate mailing of uncompressed logs

Question

The man page of logrotate has this sample configuration file:

   # sample logrotate configuration file
   compress

   /var/log/messages {
       rotate 5
       weekly
       postrotate
           /usr/bin/killall -HUP syslogd
       endscript
   }

   "/var/log/httpd/access.log" /var/log/httpd/error.log {
       rotate 5
       mail [email protected]
       size 100k
       sharedscripts
       postrotate
           /usr/bin/killall -HUP httpd
       endscript
   }

   /var/log/news/news.crit {
       monthly
       rotate 2
       olddir /var/log/news/old
       missingok
       postrotate
           kill -HUP ‘cat /var/run/inn.pid‘
       endscript
       nocompress
   }

and explains the second set of directives as follows:

The next section defines the parameters for both /var/log/httpd/access.log and /var/log/httpd/error.log. They are rotated whenever it grows over 100k in size, and the old logs files are mailed (uncompressed) to [email protected] after going through 5 rotations, rather than being removed. The sharedscripts means that the postrotate script will only be run once (after the old logs have been compressed), not once for each log which is rotated. Note that the double quotes around the first filename at the beginning of this section allows logrotate to rotate logs with spaces in the name. Normal shell quoting rules apply, with ', ", and \ characters supported.

I look at that config file and see that there is a compress directive at the top. I therefore presume that the old logs on that section will already be compressed with gzip (error.log.5.gzip, access.log.5.gzip). Are they being decompressed prior to being emailed? Is there a way to just have them mailed without decompression?

Answer 1

The logs are compressed on the local filesystem, yes, and they are decompressed while being emailed, though it seems to do this with pipes instead of files (as in gunzip /var/log/httpd/error.log.5.gz | mail "/var/log/httpd/access.log /var/log/httpd/error.log" "[email protected]"). It can't email them prior to compression, as suggested by Janne Pikkarainen, because it's emailing the least recent log - which in this case is 5 days old. It also won't result in insanely huge emails (thanks to being triggered by size 100k instead of, say, daily), assuming you run logrotate regularly - say, hourly.

If you really want the compressed version of your logs emailed to you, Dan Pritts is correct - you'll need to create a script you can call using postrotate (or prerotate) instead of using the mail feature of logrotate itself. You'll want to send the compressed logs as attachments, and there are a number of ways to approach this, with varying levels of complexity and functionality - for more, see this question about sending attachments via command line on Stack Overflow.