3

I wonder which of the logs takes precedence over the other.

Looking at rsyslog defined here, it defines daily rotation and keeping them for 30 days.

vim /etc/logrotate.d/rsyslog

/var/log/syslog
{
        rotate 30
        daily
        missingok
        notifempty
        delaycompress
        compress
        postrotate
                /usr/lib/rsyslog/rsyslog-rotate
        endscript
}

Then we have the main config, that rotates weekly and keeps 4 weeks at a time.

vim /etc/logrotate.conf

# rotate log files weekly
weekly

# use the syslog group by default, since this is the owning group
# of /var/log/syslog.
su root syslog

# keep 4 weeks worth of backlogs
rotate 4

# create new (empty) log files after rotating old ones
create

# uncomment this if you want your log files compressed
#compress

# packages drop log rotation information into this directory
include /etc/logrotate.d

Which one overrides the other one?

6

The rules are simply evaluated as they are read, and the last setting encountered overrides previous settings.

As the /etc/logrotate.conf file has the line include /etc/logrotate.d as last, the files in that directory are also processed after the main config file. Hence the /etc/logrotate.d/rsyslog file will override the settings in /etc/logrotate.conf.

The point is that you can set default values in the main config file, and override those if necessary for individual log files.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.