1

Whenever I execute ls command in /var/log directory, I could find log files, e.g. messages, and their rotated versions, e.g. messages.1.gz.

Even though I am not using any utility like logrotate, how are these files being rotated automatically? What is the criteria (e.g. log file should reach 'X' MB or it is rotated every 'N' days) for the file to be rotated? And how can I control (enable/disable) log rotation?

Note: I have written a bash script, that would run on 1st day of every month. This script would compress the log file, copy the compressed file to a remote server and empty the original log file (so that newer logs are available on the next run). So, I do not want the log file to be rotated.

  • What makes you think you aren't using logrotate? Most distributions set it up as a default. What distribution are you using? – Gilles Nov 4 '14 at 17:57
  • I am using RHEL 6.5. There is no configuration set in /etc/logrotate.conf for that particular log file. – Mandar Shinde Nov 5 '14 at 3:16
  • 1
    Ignore, the /etc/logrotate.conf file, are there any files in the /etc/logrotate.d directory like my answer asked? – devnull Nov 5 '14 at 3:40
  • There are some files in the mentioned directory, but they do not include the log file under consideration. – Mandar Shinde Nov 5 '14 at 4:24
  • 1
    Did you check the all the files for the 'file under consideration' one file in logrotate.d directory can have multiple files specified. The messages log would rotate inside this file: /etc/logrotate.d/syslog. I updated my answer with this information. – devnull Nov 5 '14 at 6:21
3

Check if there are any files here: /etc/logrotate.d

If so, remove whichever relate to what you don't want to rotate. But be careful on what you are removing, make sure that you have a file-cleanup method for all files that are rotated with logrotate otherwise you run the risk of waking up one day and not understanding how your filesystem ran out of diskspace.

Update

Multiple files can be specified within a single file in the logrotate.d directory, an example is the syslog file. This also happens to be where the messages log you mentioned would be targeted.

/etc/logrotate.d/syslog

/var/log/messages 
/var/log/secure 
/var/log/maillog /var/log/spooler /var/log/boot.log /var/log/cron {
    sharedscripts
    postrotate
        /bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null || true
        /bin/kill -HUP `cat /var/run/rsyslogd.pid 2> /dev/null` 2> /dev/null || true
    endscript
}

Update #2

Run this command to see if what is rotating your log files is syslog instead of logrotate:

grep -rni "message" /etc/cron.*/*

On Debian flavored systems, the syslog rotation can be controlled by a cron daily script which is normally located in /etc/cron.daily/sysklogd. My grep command should help identify if this is true in your case, (even though you are on RHEL).

More information can be found here: http://www.ducea.com/2006/06/06/rotating-linux-log-files-part-1-syslog/

Also check: grep -rni "message" /etc/rsyslog.d/*

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.