I am using the following setup for archiving and deleting logs:

/path/to/logs/*.log {
    rotate 4
    maxage 14


My logs location has logs that look like this:

-rwxrwxrwx 1 nobody nobody 21635 Sep 26 13:09 audit-2016.09.26.log

Which are then rotated and compressed to look like this:

-rwxrwxrwx 1 nobody  nobody    180485 Sep 10 03:41 audit-2016.09.26.log.1.gz

The problem I'm having is that, after archiving them every night, the logs are not deleted after 14 days (as the maxage directive should do).

Does anyone have any idea why is that happening or what should I change in my logrotate config?


  • Do you also have an audit.log without date? – rudimeier Sep 27 '16 at 6:28
  • No, they are always generated by the application in this format (with the date) – dinclaw Sep 27 '16 at 6:30

From logrotate man page:

maxage count

Remove rotated logs older than days. The age is only checked if the logfile is to be rotated.

audit-2016.09.26.log was only created one time and never again. So it will never be rotated again.

Actually your audit log files are already rotated. Looks like you only want to compress them and remove old files. I don't know whether this is possible with logrotate. You may add a postrotate script to your original rule, like:

           find /path/to/logs -name "*.log.1.gz" -mtime +14 -delete
  • Yes, that was exactly my intention and I've thought that might be the case. As logrotate, after it rotates the file, doesn't touch it again. But I think it must be a way of achieving what I need. Maybe if I add another setup that will take into account the .gz files (delete .gz files with maxage)? – dinclaw Sep 27 '16 at 6:40
  • Yes this could work using rotate 0 for the .gz file rule. It still looks a bit ugly that it adds such enumeration *.1.gz. I would probably put a simple script into /etc/cron.daily/ which compresses all *log files older than one day and remove all *.log.gz files older than 14 days. This script would be shorter that these logrotate rules. – rudimeier Sep 27 '16 at 6:48
  • I totally agree, but the fact is I'm forced to use logrotate, as I can't use cron on the environment I'm working in. – dinclaw Sep 27 '16 at 7:05
  • There is also a postrotate/endscript config key. You may add something like find /CPFS/logstash -name "*.log.1.gz" -mtime +14 -delete to your original rule – rudimeier Sep 27 '16 at 7:13
  • I'll try that as well and get back with a confirmation. Thanks! – dinclaw Sep 27 '16 at 8:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.