6

I have an application which rotates its own log files on an hourly basis. Each hour I want to remove all of the files more then n days old. I have to use logrotate to do this because of business policy.

So what is the logrotate equivalent of running this command every hour?

find /var/log/app -name "*.old" -mtime +1 -exec rm -f {} \;
2
  • -type f also to be sure to delete file and nothing else
    – netmonk
    Sep 15, 2015 at 12:51
  • 2
    did you have a look at man logrotate ?
    – Archemar
    Sep 15, 2015 at 13:04

2 Answers 2

4

logrotate runs once daily and the script can be found here, /etc/cron.daily/logrotate (on CentOS 7). If you want to run it each hour, you first need to move it to /etc/cron.hourly/. Then for the above command the equivalent logrotate script might look like this,

$ cat /etc/logrotate.d/app

/var/log/app/*.old {
  hourly
  rotate 0
  firstaction
    /usr/bin/find /var/log/app/ -name "*.old" -mtime +1 -delete
  endscript
  nocreate
  missingok
  notifempty
}
3
  • 1
    So basically you're saying that logrotate can't do what the OP wants, so, if they have a business policy that says they must use logrotate, then the solution is to use logrotate as a vehicle to run their find command every hour. OKAAAAAAY. I would warn the OP: this solution might be considered a policy violation. Nov 22, 2018 at 5:44
  • If you don't put, firstaction /usr/bin/find /var/log/app/ -name "*.old" -mtime +1 -delete endscript logrotate will not remove the source log file.
    – Tanveer
    Nov 22, 2018 at 6:36
  • Haha @Scott anyway the policy could not be followed then, because logrotate is incapable for things different then rotating and cleaning up files rotated by himself. The plus of this solution would be to find all this stuff in logrotate.d, but I personally would deny to follow the policy if this implies I have to reschedule logrotate to hourly for whole system. So possibly create a 2nd schedule for hourly logrotate with a dedicated config files including only hourly snippets..
    – user301446
    May 17, 2020 at 12:43
3

it's a possibility and you need to test :

cat /etc/logrotate.d/customapp

/var/log/app/*.old {
    daily
    missingok
    rotate 0
    notifempty
}

Why rotate 0 ?

If count is 0, old versions are removed rather than rotated. (source : man)

2
  • 8
    no, this wont work. logrotate will only remove files it created (rotated). source: testing, since docu doesnt cover it.
    – keen
    Jun 21, 2016 at 20:33
  • nocreate option seems to make original log file to disapear. But anyway this will not work for files which are smaller than default size parameter (logrotate skips them). At least this is what I observe in my logrotate version 3.8.6.
    – Kuchara
    Dec 2, 2020 at 13:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .