19

For my logfiles I have the problem of all but one (or a few) files use the same configuration, while the rest has another one. I tried to realize this by giving a general configuration for all files and then overwriting this configuration for the few specific files later, e.g.:

/var/log/mylogs/*.log {
                   size 1000k
                   copytruncate
                   create 0644 root root
                   rotate 99
                   compress
                   missingok
}

/var/log/mylogs/thatonespecial.log {
                   size 1000k
                   copytruncate
                   create 0644 myuser mygroup
                   rotate 99
                   compress
                   missingok
}

However, this raises an error:

error: /var/log/mylogs/logrotate.conf:10 duplicate log entry for /var/log/mylogs/thatonespecial.log

How should I handle such a situation properly? I certainly don't want to list the large number of standard log files individually, so the use of the wildcard configuration seems reasonable to me. But how can I then specify an exception among the wildcarded files?

4 Answers 4

14

The most elegant answer is to put thatonespecial.log in a separate directory so it wouldn't be able to match the wildcard.

If that won't work, then you can use globs to narrow down your wildcard. It's messy, but if you absolutely can't move the file location then it's probably your only real option. Something like this:

/var/log/mylogs/[!t][!h]*.log

Would match any .log files with at least 2 characters in their name that don't start with "th".

2
  • 3
    This doesn't work as expected. Filename that.log will be ignored, but filename txxx.log will be ignored as well. For some reason the [!h] part is not playing any role. As soon as a file starts with t, then it'll be ignored.
    – cherouvim
    Sep 26, 2019 at 13:27
  • this not work in example /var/log/nginx/[!access].log the error.log not rotate but access.log rotate in another configure below
    – flourigh
    Mar 17, 2021 at 12:32
10

It seems that the overwriting of rules was implemented and it works now:

$ logrotate --version
logrotate 3.8.7

$ cat /etc/logrotate.d/test
# rotate application logs for 40 days by default
/home/myapp/log/*.log
/home/myapp/log/*/*.log
{
    daily
    compress
    delaycompress
    rotate 40
}

# rotate access logs for 1 year
/home/myapp/log/access/*.log {
    daily
    compress
    delaycompress
    rotate 365
}

$ logrotate  -d /etc/logrotate.d/test
reading config file /etc/logrotate.d/test

Handling 2 logs

rotating pattern: /home/myapp/log/*.log
/home/myapp/log/*/*.log
 after 1 days (40 rotations)
empty log files are not rotated, old logs are removed
No logs found. Rotation not needed.

rotating pattern: /home/myapp/log/access/*.log  after 1 days (365 rotations)
empty log files are not rotated, old logs are removed
No logs found. Rotation not needed.

While when tested on my local logrotate (version 3.7.8) the error was raised:

$ cat logr.conf 
# rotate application logs for 40 days by default
/home/myapp/log/*.log
/home/myapp/log/*/*.log
{
    daily
    compress
    delaycompress
    rotate 40
}

# rotate access logs for 1 year
/home/myapp/log/access/*.log {
    daily
    compress
    delaycompress
    rotate 365
}

$ logrotate -d logr.conf 
reading config file logr.conf
reading config info for /home/myapp/log/*.log
/home/myapp/log/*/*.log

error: logr.conf:12 duplicate log entry for /home/myapp/log/access/api_access.log
error: found error in /home/myapp/log/access/*.log , skipping
removing last 1 log configs

...
3
  • Very nice. I want to emphasize one thing because it's a bit counter-intuitive: the man page states: "later definitions override earlier ones." Your example is correct; I'm just saying this because I had expected the opposite would have been the case.
    – drumfire
    Jul 18, 2020 at 21:59
  • 1
    This doesn't work for me using logrotate 3.13.0 distributed as an alpine package. Different implementation perhaps...
    – helvete
    Oct 9, 2020 at 12:06
  • Same error here with logrotate 3.18.0 from Debian 11.5 Bullseye: duplicate log entry for...
    – 4wk_
    Oct 26, 2023 at 9:30
2

If you know the names of all logs, you could also specify them together in one rule:

/var/log/mylogs/{file1,file2,file3,file4,file5}.log {
    size 1000k
    copytruncate
    create 0644 root root
    rotate 99
    compress
    missingok
}

/var/log/mylogs/thatonespecial.log {
    size 1000k
    copytruncate
    create 0644 myuser mygroup
    rotate 99
    compress
    missingok
}
0

Thks Hyppy I had the same issue here and Your solution ([!x][!y]*.log) worked just fine I tried to vote your answer as usefull, but still i have not enough reputation :( So, here is my thk you

And for flourigh, in your config ( [!access] ) keep in mind that all characters inside the brackets is for catch one sigle character, so your config will catch only files NOT (!) beggining with a, c, e & s only (first char only, ok?) good reference here: https://manpages.ubuntu.com/manpages/noble/en/man7/glob.7.html (on complementation paragraph)

You should expand it to [!a][!c][!c][!e].... or find another way to aim that file only

1

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .