I've been having some trouble with logrotate, it seemingly does not do what I'm telling it to do.


  • Centos 6.4
  • logrotate 3.7.8

My /etc/logrotate.conf file has the following:

# rotate log files weekly

# keep 4 weeks worth of backlogs
rotate 30

# create new (empty) log files after rotating old ones

# use date as a suffix of the rotated file
# dateext

# uncomment this if you want your log files compressed
compresscmd /usr/bin/bzip2
uncompresscmd /usr/bin/bunzip2
compressext .bz2

# RPM packages drop log rotation information into this directory
include /etc/logrotate.d

And the logrotate file I'm having trouble with is this (for elasticsearch, located at /etc/logrotate.d/elasticsearch):

/var/log/elasticsearch/*.log {
        rm -rf /var/log/elasticsearch/*.log.$(date +%Y)*
    size 1k
    rotate 7

First of all, it's not respecting my rotate 7 configuration, when I run logrotate -d /etc/logrotate.conf, I get a line saying:

rotating log /var/log/elasticsearch/gravity-es-prod02.log, log->rotateCount is 30

... and a bunch of statements saying it's rotating 30 different *.bz2 files.

Secondly, I keep ending up with a logfile that is named gravity-es-prod02.log.2015-12-01 (and any previous dates since my last manual cleanup), despite not having dateext enabled. These also don't get cleaned up, so I added the postrotate line to manually clean it up, but apparently that doesn't work correctly either.

EDIT The cron file that runs the logrotate script is pretty standard:

#> cat /etc/cron.daily/logrotate 

/usr/sbin/logrotate /etc/logrotate.conf >/dev/null 2>&1
if [ $EXITVALUE != 0 ]; then
    /usr/bin/logger -t logrotate "ALERT exited abnormally with [$EXITVALUE]"
exit 0
  • What is the full pathname to the file containing your elastic search logrotate definition? How did you create this file? (Did it come from Windows?)
    – roaima
    Dec 2, 2015 at 21:57
  • updated, it didn't come from windows, it was created from a chef template file
    – BrDaHa
    Dec 2, 2015 at 22:00
  • What you've shown looks sound. I don't suppose one of the other files in /etc/logrotate.d have mistakenly got global settings in them? Specifically the dateext verb.
    – roaima
    Dec 2, 2015 at 22:31
  • nope, nothing but the commented out one in logrotate.conf
    – BrDaHa
    Dec 2, 2015 at 22:51
  • "Any number of config files may be given on the command line." Can you find the cron job that runs logrotate and check that it's not including additional logrotate.conf files other than the single one you're expecting. It's /etc/cron.daily/logrotate on my Debian (Wheezy) system.
    – roaima
    Dec 2, 2015 at 22:54

1 Answer 1


I found an error in your provided script (missing endscript):

    rm -rf /var/log/elasticsearch/*.log.$(date +%Y)*

I believe this part fails and somehow applies global settings for this log pattern.

  • Thank you! I actually just found this out myself, looking at the output of the last run cronjob. I missed it the first time when I was debugging
    – BrDaHa
    Dec 3, 2015 at 19:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.