0

I've been having some trouble with logrotate, it seemingly does not do what I'm telling it to do.

Environment:

  • Centos 6.4
  • logrotate 3.7.8

My /etc/logrotate.conf file has the following:

# rotate log files weekly
daily

# keep 4 weeks worth of backlogs
rotate 30

# create new (empty) log files after rotating old ones
create

# use date as a suffix of the rotated file
# dateext

# uncomment this if you want your log files compressed
compress
compresscmd /usr/bin/bzip2
uncompresscmd /usr/bin/bunzip2
compressext .bz2

# RPM packages drop log rotation information into this directory
include /etc/logrotate.d

And the logrotate file I'm having trouble with is this (for elasticsearch, located at /etc/logrotate.d/elasticsearch):

/var/log/elasticsearch/*.log {
    missingok
    notifempty
    copytruncate
    postrotate
        rm -rf /var/log/elasticsearch/*.log.$(date +%Y)*
    size 1k
    rotate 7
    daily
}

First of all, it's not respecting my rotate 7 configuration, when I run logrotate -d /etc/logrotate.conf, I get a line saying:

rotating log /var/log/elasticsearch/gravity-es-prod02.log, log->rotateCount is 30

... and a bunch of statements saying it's rotating 30 different *.bz2 files.

Secondly, I keep ending up with a logfile that is named gravity-es-prod02.log.2015-12-01 (and any previous dates since my last manual cleanup), despite not having dateext enabled. These also don't get cleaned up, so I added the postrotate line to manually clean it up, but apparently that doesn't work correctly either.

EDIT The cron file that runs the logrotate script is pretty standard:

#> cat /etc/cron.daily/logrotate 
#!/bin/sh

/usr/sbin/logrotate /etc/logrotate.conf >/dev/null 2>&1
EXITVALUE=$?
if [ $EXITVALUE != 0 ]; then
    /usr/bin/logger -t logrotate "ALERT exited abnormally with [$EXITVALUE]"
fi
exit 0
  • What is the full pathname to the file containing your elastic search logrotate definition? How did you create this file? (Did it come from Windows?) – roaima Dec 2 '15 at 21:57
  • updated, it didn't come from windows, it was created from a chef template file – BrDaHa Dec 2 '15 at 22:00
  • What you've shown looks sound. I don't suppose one of the other files in /etc/logrotate.d have mistakenly got global settings in them? Specifically the dateext verb. – roaima Dec 2 '15 at 22:31
  • nope, nothing but the commented out one in logrotate.conf – BrDaHa Dec 2 '15 at 22:51
  • "Any number of config files may be given on the command line." Can you find the cron job that runs logrotate and check that it's not including additional logrotate.conf files other than the single one you're expecting. It's /etc/cron.daily/logrotate on my Debian (Wheezy) system. – roaima Dec 2 '15 at 22:54
1

I found an error in your provided script (missing endscript):

postrotate
    rm -rf /var/log/elasticsearch/*.log.$(date +%Y)*
endscript

I believe this part fails and somehow applies global settings for this log pattern.

  • Thank you! I actually just found this out myself, looking at the output of the last run cronjob. I missed it the first time when I was debugging – BrDaHa Dec 3 '15 at 19:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.