7

the logs on /var/log/ (Debian/Ubuntu) are stored as

x.log
x.log.1
x.log.2.gz
...

like kernel logs, syslogs, etc.

I see that as the log info increases, they are stored by splitting into smaller files (rather than keeping all in a single file). I wonder why the second file (x.log.1) is not compressed? Is it something to do with accessing more recent logs easier?

7

I agree with you, that should only provide an easier access to recent files. Anyway, the actual behaviour is decided via logrotate 'delaycompress' directive, which says 'do not compress the file as you rotate, but compress it next time'.

The hystorical reason can be somehow found in logrotate manual:

Postpone  compression of the previous log file to the next rotation 
cycle.  This has only effect when used in combination  with compress. 
It can be used when some program can not be told to close its logfile and 
thus might continue writing to the  previous log file for some time.
  • 1
    "(...) when some program can not be told to close its logfile immediately and thus (...)". Found this precision in a post on Server Fault. – Ludovic Kuty Apr 1 '16 at 8:10
3

Yes, this is done so that more recent log files are easier to access. The logrotate option delaycompress controls this. From the logrotate manpage:

delaycompress

Postpone compression of the previous log file to the next rotation cycle.  
This only has effect when used in combination with
compress.  It can be  used  when  some  program
cannot be told to close its logfile and thus might 
continue writing to the previous log file for some time.
  • 3
    These options are used in the files under /etc/logrotate.conf and /etc/logrotate.d/*. – slm Aug 7 '13 at 15:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.