CODEWITHSUNDEEP
linuxcentos6logrotate
Mike McCormick
Mike McCormick

Reputation: 121

Logrotate not compressing

We have syslogd set up to send all logs from a few different servers into one, all into a folder called /var/log/centrallogs.

We're using the following log rotate config for this directory:

/etc/logrotate.d/centrallogs:

/var/log/centrallogs/*log {
        rotate 5
        compress
        missingok
        notifempty
        sharedscripts
        postrotate
        /etc/init.d/httpd restart > /dev/null 2>/dev/null || true
        endscript
}

In testing (using logrotate -d centrallogs) LR doesn't appear to try to do any rotating.

Here's the output (Note, I've renamed the sites, however that's the only change I've made):

rotating pattern: /var/log/centrallogs/*log  1048576 bytes (5 rotations)
empty log files are not rotated, old logs are removed
considering log /var/log/centrallogs/site1_access.log
  log needs rotating
considering log /var/log/centrallogs/site1_error.log
  log does not need rotating
considering log /var/log/centrallogs/site2_access.log
  log needs rotating
considering log /var/log/centrallogs/site2_error.log
  log needs rotating
considering log /var/log/centrallogs/site3_access.log
  log needs rotating
considering log /var/log/centrallogs/site3_error.log
  log needs rotating
rotating log /var/log/centrallogs/site1_access.log, log->rotateCount is 5
dateext suffix '-20150908'
glob pattern '-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]'
renaming /var/log/centrallogs/site1_access.log.5.gz to /var/log/centrallogs/site1_access.log.6.gz (rotatecount 5, logstart 1, i 5), 
renaming /var/log/centrallogs/site1_access.log.4.gz to /var/log/centrallogs/site1_access.log.5.gz (rotatecount 5, logstart 1, i 4), 
renaming /var/log/centrallogs/site1_access.log.3.gz to /var/log/centrallogs/site1_access.log.4.gz (rotatecount 5, logstart 1, i 3), 
renaming /var/log/centrallogs/site1_access.log.2.gz to /var/log/centrallogs/site1_access.log.3.gz (rotatecount 5, logstart 1, i 2), 
renaming /var/log/centrallogs/site1_access.log.1.gz to /var/log/centrallogs/site1_access.log.2.gz (rotatecount 5, logstart 1, i 1), 
renaming /var/log/centrallogs/site1_access.log.0.gz to /var/log/centrallogs/site1_access.log.1.gz (rotatecount 5, logstart 1, i 0), 
rotating log /var/log/centrallogs/site2_access.log, log->rotateCount is 5
dateext suffix '-20150908'
glob pattern '-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]'
renaming /var/log/centrallogs/site2_access.log.5.gz to /var/log/centrallogs/site2_access.log.6.gz (rotatecount 5, logstart 1, i 5), 
renaming /var/log/centrallogs/site2_access.log.4.gz to /var/log/centrallogs/site2_access.log.5.gz (rotatecount 5, logstart 1, i 4), 
renaming /var/log/centrallogs/site2_access.log.3.gz to /var/log/centrallogs/site2_access.log.4.gz (rotatecount 5, logstart 1, i 3), 
renaming /var/log/centrallogs/site2_access.log.2.gz to /var/log/centrallogs/site2_access.log.3.gz (rotatecount 5, logstart 1, i 2), 
renaming /var/log/centrallogs/site2_access.log.1.gz to /var/log/centrallogs/site2_access.log.2.gz (rotatecount 5, logstart 1, i 1), 
renaming /var/log/centrallogs/site2_access.log.0.gz to /var/log/centrallogs/site2_access.log.1.gz (rotatecount 5, logstart 1, i 0), 
rotating log /var/log/centrallogs/site2_error.log, log->rotateCount is 5
dateext suffix '-20150908'
glob pattern '-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]'
renaming /var/log/centrallogs/site2_error.log.5.gz to /var/log/centrallogs/site2_error.log.6.gz (rotatecount 5, logstart 1, i 5), 
renaming /var/log/centrallogs/site2_error.log.4.gz to /var/log/centrallogs/site2_error.log.5.gz (rotatecount 5, logstart 1, i 4), 
renaming /var/log/centrallogs/site2_error.log.3.gz to /var/log/centrallogs/site2_error.log.4.gz (rotatecount 5, logstart 1, i 3), 
renaming /var/log/centrallogs/site2_error.log.2.gz to /var/log/centrallogs/site2_error.log.3.gz (rotatecount 5, logstart 1, i 2), 
renaming /var/log/centrallogs/site2_error.log.1.gz to /var/log/centrallogs/site2_error.log.2.gz (rotatecount 5, logstart 1, i 1), 
renaming /var/log/centrallogs/site2_error.log.0.gz to /var/log/centrallogs/site2_error.log.1.gz (rotatecount 5, logstart 1, i 0), 
rotating log /var/log/centrallogs/site3_access.log, log->rotateCount is 5
dateext suffix '-20150908'
glob pattern '-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]'
renaming /var/log/centrallogs/site3_access.log.5.gz to /var/log/centrallogs/site3_access.log.6.gz (rotatecount 5, logstart 1, i 5), 
renaming /var/log/centrallogs/site3_access.log.4.gz to /var/log/centrallogs/site3_access.log.5.gz (rotatecount 5, logstart 1, i 4), 
renaming /var/log/centrallogs/site3_access.log.3.gz to /var/log/centrallogs/site3_access.log.4.gz (rotatecount 5, logstart 1, i 3), 
renaming /var/log/centrallogs/site3_access.log.2.gz to /var/log/centrallogs/site3_access.log.3.gz (rotatecount 5, logstart 1, i 2), 
renaming /var/log/centrallogs/site3_access.log.1.gz to /var/log/centrallogs/site3_access.log.2.gz (rotatecount 5, logstart 1, i 1), 
renaming /var/log/centrallogs/site3_access.log.0.gz to /var/log/centrallogs/site3_access.log.1.gz (rotatecount 5, logstart 1, i 0), 
rotating log /var/log/centrallogs/site3_error.log, log->rotateCount is 5
dateext suffix '-20150908'
glob pattern '-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]'
renaming /var/log/centrallogs/site3_error.log.5.gz to /var/log/centrallogs/site3_error.log.6.gz (rotatecount 5, logstart 1, i 5), 
renaming /var/log/centrallogs/site3_error.log.4.gz to /var/log/centrallogs/site3_error.log.5.gz (rotatecount 5, logstart 1, i 4), 
renaming /var/log/centrallogs/site3_error.log.3.gz to /var/log/centrallogs/site3_error.log.4.gz (rotatecount 5, logstart 1, i 3), 
renaming /var/log/centrallogs/site3_error.log.2.gz to /var/log/centrallogs/site3_error.log.3.gz (rotatecount 5, logstart 1, i 2), 
renaming /var/log/centrallogs/site3_error.log.1.gz to /var/log/centrallogs/site3_error.log.2.gz (rotatecount 5, logstart 1, i 1), 
renaming /var/log/centrallogs/site3_error.log.0.gz to /var/log/centrallogs/site3_error.log.1.gz (rotatecount 5, logstart 1, i 0), 
renaming /var/log/centrallogs/site1_access.log to /var/log/centrallogs/site1_access.log.1
renaming /var/log/centrallogs/site2_access.log to /var/log/centrallogs/site2_access.log.1
renaming /var/log/centrallogs/site2_error.log to /var/log/centrallogs/site2_error.log.1
renaming /var/log/centrallogs/site3_access.log to /var/log/centrallogs/site3_access.log.1
renaming /var/log/centrallogs/site3_error.log to /var/log/centrallogs/site3_error.log.1
running postrotate script
running script with arg /var/log/centrallogs/*log : "
    /etc/init.d/httpd restart > /dev/null 2>/dev/null || true
"
compressing log with: /bin/gzip
removing old log /var/log/centrallogs/site1_access.log.6.gz
error: error opening /var/log/centrallogs/site1_access.log.6.gz: No such file or directory

I've tried using delaycompress too instead since some people have had success with that.

LR rotates the logs just fine, it just doesn't perform compression on them at all.

Looking at the only error-sounding part of that output:

error: error opening /var/log/centrallogs/site1_access.log.6.gz: No such file or directory

I figured LR might be freaking out because it didn't have a .gz file to remove, so I created every variation of log file needed, it ran over night, cleared out the gz's, rotated, but still didn't compress.

This is driving me a bit mad, any help would be gratefully received.

Upvotes: 5

Views: 23734

Answers (4)

Antony
Antony

Reputation: 1

I had a similar problem : logrotate did not compress Apache log files with delaycompress under RHEL8 (logrotate-3.14.0-4.el8) whereas it was working under RHEL6 (logrotate-3.7.8-26.el6) with exactly the same configuration.

It seems that logrotate have changed its behaviour in case of delaycompress without explicit compress : in 3.7 compress was implicitly assumed, in 3.14 delaycompress have no effect (as it has always been specified in the man page). Adding compress before delaycompress solved my problem on version 3.14.

RedHat didn't took this into account, so RHEL8 do not compress Apache log files by default, whereas previous versions did.

Upvotes: 0

mondrillo
mondrillo

Reputation: 1

logrotate -fv /etc/logrotate.d/centrallogs

-f force rotation, -d debug mode only show more info, and -v verbose mode

Upvotes: 0

Vishwas M.R
Vishwas M.R

Reputation: 1669

Responding specifically to your observation that the delay compress did not work - Please note that the delaycompress facility only compresses the previous log file in the next rotation cycle. As explained here in man logrotate

delaycompress
      Postpone compression of the previous log file to the next rotation cycle.  
      This only has effect when used in combination with compress.

Upvotes: 0

Alex North-Keys
Alex North-Keys

Reputation: 4363

Based on the log, it looks like it's running /bin/gzip, and normally gzip will compress all listed files - skipping any that are were missing - with no trouble. Note that gzip will not forcibly compress files if the results are bigger, which can happen on very small files pretty easily. The "error: error [..]" message likely isn't from gzip, which tends to prefix errors with "gzip: :".

Check the file sizes to see if they're small (or more specifically, if gzip thinks compressing them will make them bigger).

Similar comments for notifempty.

The delaycompress just means you can have .1 .2 .3 .4.gz .5.gz and the like. It's not necessary to make compress work, and actually makes it skip compressing most recent few files. You'd use both, or just compress, not delaycompress by itself.

It's weird that you don't have a frequency/size { daily | weekly | size ___ } in your file. I've never tried to use them without one.

Upvotes: 4

Related Questions