I have a bunch of messages files in /var/log that stretches all the way to April of 2017 (not posting the whole output of ls as there are a lot of files) The archived messages go from messages.2.gz to messages.250.gz:

-rw------- 1 root root 231K Jul 28 06:22 messages.13.gz
-rw------- 1 root root 238K Jul 28 16:06 messages.12.gz
-rw------- 1 root root 253K Jul 29 01:04 messages.11.gz
-rw------- 1 root root 238K Jul 29 10:43 messages.10.gz
-rw------- 1 root root 247K Jul 29 20:40 messages.9.gz
-rw------- 1 root root 246K Aug  1 07:19 messages.7.gz
-rw------- 1 root root 253K Aug  1 16:34 messages.6.gz
-rw------- 1 root root 246K Aug  2 02:36 messages.5.gz
-rw------- 1 root root 239K Aug  2 12:16 messages.4.gz
-rw------- 1 root root 246K Aug  2 22:14 messages.3.gz
-rw------- 1 root root 237K Aug  3 07:51 messages.2.gz
-rw------- 1 root root 1.2M Aug  3 10:20 messages.1
-rw------- 1 root root 129K Aug  3 10:30 messages

And according to my configuration in /etc/logrotate.conf:

# see "man logrotate" for details
# rotate log files weekly

# keep 4 weeks worth of backlogs
rotate 7

# create new (empty) log files after rotating old ones

# uncomment this if you want your log files compressed

# RPM packages drop log rotation information into this directory
include /etc/logrotate.d

# no packages own wtmp -- we'll rotate them here
/var/log/wtmp {
    minsize 1M
    create 0664 root utmp
    rotate 1

/var/log/btmp {
    minsize 1M
    create 0600 root utmp
    rotate 1

# system-specific logs may be also be configured here.

It should be only keeping a weeks worth of logs globally. I also made some changes to /etc/logrotate.d/syslog to further troubleshoot:

/var/log/messages /var/log/secure /var/log/maillog /var/log/spooler /var/log/boot.log /var/log/cron {
    rotate 7

        /bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null || true
        /bin/kill -HUP `cat /var/run/rsyslogd.pid 2> /dev/null` 2> /dev/null || true

When running in debug, I see this:

[root@foo log]# logrotate -d /etc/logrotate.d/syslog
reading config file /etc/logrotate.d/syslog
reading config info for /var/log/messages /var/log/secure /var/log/maillog /var/log/spooler /var/log/boot.log /var/log/cron

Handling 1 logs

rotating pattern: /var/log/messages /var/log/secure /var/log/maillog /var/log/spooler /var/log/boot.log /var/log/cron  after 1 days (7 rotations)
empty log files are rotated, old logs are removed
considering log /var/log/messages
  log does not need rotating
considering log /var/log/secure
  log does not need rotating
considering log /var/log/maillog
  log does not need rotating
considering log /var/log/spooler
  log does not need rotating
considering log /var/log/boot.log
  log does not need rotating
considering log /var/log/cron
  log does not need rotating
not running postrotate script, since no logs were rotated

Can someone tell me based on this information why logrotate is not deleting older log files? Im sure that the configuration should be deleting the files when running manually but it doesn't seem to be the case...

Update: I set the maxage in the /etc/logrotate.d/syslog to 7. Interestingly enough it deleted the messages.8.gz but would not proceed to delete anything further? Why would that be?

  • It did not delete further because it does not guess they are there. – Rui F Ribeiro Aug 3 '17 at 19:21
  • 1
    @RuiFRibeiro Can you please elaborate? – ryekayo Aug 3 '17 at 22:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.