0

I saw the size directive and created the configuration file /etc/logrotate.d/test:

/home/user/log1 {
    size 100
    rotate 3
    compress
}

but it doesn't work as I expect. The file should be rotated when its size becomes more than 100 bytes, and this does not happen. Nothing happens when the file size exceeds the limit, the file is not rotated, a new archive with the old log1 file is not created

Is it possible to achieve this behavior with logrotate?

OS is ubuntu 20

Improve this question
4
  • 1
    The rotation will happen when logrotate runs, and that's probably once a day or so by default in most distros. You might want to try something like github.com/jbaublitz/logrustate (based on Google results for a logrotate that can "watch" for things, never tried it myself) Commented Dec 5, 2022 at 11:37
  • Please edit your question and add more details. What exactly means "it doesn't work as I expect"? You wrote what you expect, but not what actually happens. Does it rotate the logfile at all? What size do the rotated files have? At what date/time did the rotation take place? Commented Dec 5, 2022 at 11:54
  • please provide your OS release info as well Commented Dec 5, 2022 at 12:02
  • 2
    logrotate is not a daemon that runs in the background and is able to react when the file grows. It's a program run from cron, anacron or systemd, usually once a day. To see if your config works, you need to wait until logrotate runs; or you need to start it manually, it will do its job and will exit. Commented Dec 5, 2022 at 12:11

1 Answer 1

Reset to default
1

This has been answered in logrotate by size - do I need to change the cron? (on Server Fault) (and by @kamil-maciorowski):

Yes, you need to run logrotate more than once a day to achieve this. This is answered in the seconds paragraph of the man page logrotate(8):

Normally, logrotate is run as a daily cron job. It will not modify a log multiple times in one day unless the criterion for that log is based on the log's size and logrotate is being run multiple times each day, or unless the -f or --force option is used.

If you would like to run logrotate hourly instead of daily, you can move it:

mv /etc/cron.daily/logrotate /etc/cron.hourly

Since 3.8.1 there has been maxsize. The difference between size and maxsize is described here:

maxsize size

    Log files are rotated when they grow bigger than size bytes even before the additionally specified time interval (daily, weekly, monthly, or yearly). The related size option is similar except that it is mutually exclusive with the time interval options, and it causes log files to be rotated without regard for the last rotation time. When maxsize is used, both the size and timestamp of a log file are considered.

This would make both suitable for your use: size without any interval and maxsize if also interval is needed. However, this doesn't change the fact that by default logrotate runs only daily. That interval is suitable for most, as in most cases it takes a lot longer than a day for a log to grow over 250M.

Improve this answer

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.