logrotate : size mentioned 2000M in connf still logs size is more than 2000M

Question

My /etc/logrotate.conf :

# see "man logrotate" for details
# rotate log files weekly
weekly

# keep 4 weeks worth of backlogs
rotate 4

# create new (empty) log files after rotating old ones
create

# use date as a suffix of the rotated file
dateext

# uncomment this if you want your log files compressed
#compress

# RPM packages drop log rotation information into this directory
include /etc/logrotate.d

# no packages own wtmp and btmp -- we'll rotate them here
/var/log/wtmp {
    monthly
    create 0664 root utmp
        minsize 1M
    rotate 1
}

/var/log/btmp {
    missingok
    monthly
    create 0600 root utmp
    rotate 1
}

# system-specific logs may be also be configured here.

My Logs to be rotated /etc/logrotate.d/apc_rtbinfo.conf

/mnt/log/frengo/apc_rtbinfo.log {
daily
missingok
notifempty
size 2000M
compress
delaycompress
sharedscripts
copytruncate
rotate 3
}

Output for logrotate :

 logrotate -v /etc/logrotate.d/apc_rtbinfo.conf
reading config file /etc/logrotate.d/apc_rtbinfo.conf
reading config info for /mnt/log/frengo/apc_rtbinfo.log

Handling 1 logs

rotating pattern: /mnt/log/frengo/apc_rtbinfo.log  2097152000 bytes (3 rotations)
empty log files are not rotated, old logs are removed
considering log /mnt/log/frengo/apc_rtbinfo.log
  log does not need rotating

My rotated Logs size :

# du -sh /mnt/log/frengo/apc_rtbinfo.log*
0       /mnt/log/frengo/apc_rtbinfo.log
4.7G    /mnt/log/frengo/apc_rtbinfo.log.1
80M     /mnt/log/frengo/apc_rtbinfo.log.2
0       /mnt/log/frengo/apc_rtbinfo.log-20151222
679M    /mnt/log/frengo/apc_rtbinfo.log-20151225.gz
681M    /mnt/log/frengo/apc_rtbinfo.log-20151226.gz
691M    /mnt/log/frengo/apc_rtbinfo.log-20151227.gz
0       /mnt/log/frengo/apc_rtbinfo.log-20151228
70M     /mnt/log/frengo/apc_rtbinfo.log.2.gz
80M     /mnt/log/frengo/apc_rtbinfo.log.3
80M     /mnt/log/frengo/apc_rtbinfo.log.4

Log rotate output says "log does not need rotating" but I have mentioned "size 2000M" ie Log file is rotated if it grow bigger than 2000M then how come "/mnt/log/frengo/apc_rtbinfo.log.1" is 4.7 GB

Answer 1

It's the current log file's size (/mnt/log/frengo/apc_rtbinfo.log) that is considered, and that size is 0. So, nothing to rotate.

As for the older log file, logrotate doesn't constantly monitor files, but is run regularly (daily, iirc). If, between runs, a log file grows extraordinarily large, it won't find out until the next run.

If space is at a premium, just run gzip on the large file:

gzip /mnt/log/frengo/apc_rtbinfo.log

It will be replaced with a compressed, much smaller, file.

You have used the size and daily conditions together. However, size and the time-based conditions are mutually exclusive. You should use the maxsize condition instead:

maxsize size
      Log files are rotated when they grow bigger than size bytes even
      before the additionally specified time interval (daily,  weekly,
      monthly,  or yearly).  The related size option is similar except
      that it is mutually exclusive with the  time  interval  options,
      and  it  causes  log  files to be rotated without regard for the
      last rotation time.  When maxsize is used,  both  the  size  and
      timestamp of a log file are considered.