CODEWITHSUNDEEP
linuxubuntulogrotate
Roni Baby
Roni Baby

Reputation: 111

Size rule not working in logrotate

I created a log-rotate option for our docker logs and it is working fine. Here is the configuration file

*root@aerogear:/var/lib/docker/containers/b8da13f8dc6cb642959103c23db2a02ef2c7291ae5f94625a92ac9329db1647e# cat /etc/logrotate.d/docker-container
/var/lib/docker/containers/*/*.log {
  rotate 7
  hourly
  compress
  size=100M
  missingok
  delaycompress
  copytruncate
}*

It seems that hourly logrotate is working fine. But because of some error, this log file was increased up to 18G, because the size=100M rule didn't work in that case. Do you know any specific reason for that?

Upvotes: 4

Views: 11501

Answers (2)

Alexis Wilke
Alexis Wilke

Reputation: 20731

As mentioned by Ronan, size and hourly are "contradictory". One or the other may be used, but it is likely that one has priority, so you need to use maxsize instead.

Next:

Normally, logrotate is run as a daily cron job. It will not modify a log more than once in one day unless the criterion for that log is based on the log's size and logrotate is being run more than once each day, or unless the -f or --force option is used.

(from logrotate manual page)

On a standard Ubuntu installation, logrotate runs once per day. If you look at the cron installation, you will see logrotate under the cron.daily directory:

prompt$ ls -l /var/cron.daily
...
-rwxr-xr-x 1 root root  372 May  6  2015 logrotate
...

And there is nothing under cron.hourly:

prompt$ ls -l /var/cron.hourly
(nothing)

This shows that an hourly setup for logrotate is not going to be responding any more than a daily setup on a default setup. Of course, you can change that and get logrotate to run once an hour or even once a minute (in this last case, you need a crontab for root). But by default a maxsize with an hourly or daily setup is not useful since the file will be rotated each time anyway, whatever the size.

Also there has been versions of logrotate where the maxsize parameter did not work. This should not be an issue in the newer versions.

And as Ronan mentioned, no = sign between the option and value.

Upvotes: 7

Ronan Boiteau
Ronan Boiteau

Reputation: 10138

  • There shouldn't be an equal sign after size.
  • If you want to rotate both hourly and when the file grows bigger than 100M, then you should use maxsize instead of size.

So you should try maxsize 100M instead of size=100M.

Upvotes: 7

Related Questions