Move compressed log files outside /var/log [logrotate with log2ram]

Question

I am looking for advice about logrotate.

I have recently installed log2ram to spare my ssd. Since I was not using all 24Gb RAM I assigned 2Gb to /var/log/. currently +- 300Mb is used.

I would like logrotate to move any file ending with .gz potentially in any sub-direcory to /var/old.log/ and maintain the sub-directory structure.

I have done some research and found a possible solution but now raises questions.

Preserve directory structure when moving files using find

Compress old log files and move to new directory

1. When logrotate runs this side script to move these files for example i moves /var/log/file.log.2.gz will it then not create a new file.log.2.gz when rotating logs instead of moving file.log.2.gz to file.log.3.gz as file.log.2.gz is no longer there. Then eventually the script overwrites the old logs due to the same name

2. I do not fully understand the olddir option as I understand this could do what I want. but manual states be cautious with wildcards. any help here

3. When to time this, /var/log is created during boot with the contents of /var/hdd.log/ it then updates /var/hdd.log when rebooting.

I want logrotate to move the compressed files to a other directory so It will not be loaded on the tmpfs but I don't want to edit each /etc/logrotate.d/* file.

I thought maybe put something before log2ram creates /var/log during boot but I do not know where.

This system runs 24/7 and I try to reboot as minimal as possible. OS: Ubuntu 22.04 LTS

Sometimes manuals are too obvious sometimes there very vague. Maybe someone can explain it in a more complex or easier way for me to understand.

Thank you for your time.

Answer 1

1. Yes, using the mv command without any options will overwrite any files with the same name. One option to prevent this is to use the --backup=numbered option, which creates a new file with the format filename~*[number]*~ instead of overwriting the existing file. Another option is to make use of other file naming formats like dateext, which renames rotated logs to filename-YYYYMMDD to avoid overwriting files with the same name.

2. olddir is the location where rotated logs should be stored. The logrotate man page warns against using wildcards, because if this option is absent, then rotated logs are stored in the same directory. If a wildcard is used to signal logrotate to rotate all files (*), then it would affect rotated logs too.

3. To define a task to be done at boot and shutdown, I suggest using either cronjobs or custom-written init services. Here is an example that should help fix your issue with logrotate:

/var/log/**/*.log {
    daily
    compress
    dateext
    missingok
    noifempty
    sharedscripts
    postrotate
        cd /var/log && find . -type f -name '*.gz' -exec rsync -aR {} /var/old.log/ \;
    endscript