How to specify exceptions from wildcard settings in a logrotate configuration file?

Question

For my logfiles I have the problem of all but one (or a few) files use the same configuration, while the rest has another one. I tried to realize this by giving a general configuration for all files and then overwriting this configuration for the few specific files later, e.g.:

/var/log/mylogs/*.log {
                   size 1000k
                   copytruncate
                   create 0644 root root
                   rotate 99
                   compress
                   missingok
}

/var/log/mylogs/thatonespecial.log {
                   size 1000k
                   copytruncate
                   create 0644 myuser mygroup
                   rotate 99
                   compress
                   missingok
}

However, this raises an error:

error: /var/log/mylogs/logrotate.conf:10 duplicate log entry for /var/log/mylogs/thatonespecial.log

How should I handle such a situation properly? I certainly don't want to list the large number of standard log files individually, so the use of the wildcard configuration seems reasonable to me. But how can I then specify an exception among the wildcarded files?

score 13 · Accepted Answer · answered Feb 05 '15 at 16:19

13

The most elegant answer is to put thatonespecial.log in a separate directory so it wouldn't be able to match the wildcard.

If that won't work, then you can use globs to narrow down your wildcard. It's messy, but if you absolutely can't move the file location then it's probably your only real option. Something like this:

/var/log/mylogs/[!t][!h]*.log

Would match any .log files with at least 2 characters in their name that don't start with "th".

answered Feb 05 '15 at 16:19

Hyppy

15,608
1
38
59

2

This doesn't work as expected. Filename `that.log` will be ignored, but filename `txxx.log` will be ignored as well. For some reason the `[!h]` part is not playing any role. As soon as a file starts with `t`, then it'll be ignored. – cherouvim Sep 26 '19 at 13:27
this not work in example `/var/log/nginx/[!access].log` the error.log not rotate but access.log rotate in another configure below – flourigh Mar 17 '21 at 12:32

score 8 · Answer 2 · answered Jun 01 '15 at 10:42

It seems that the overwriting of rules was implemented and it works now:

$ logrotate --version
logrotate 3.8.7

$ cat /etc/logrotate.d/test
# rotate application logs for 40 days by default
/home/myapp/log/*.log
/home/myapp/log/*/*.log
{
    daily
    compress
    delaycompress
    rotate 40
}

# rotate access logs for 1 year
/home/myapp/log/access/*.log {
    daily
    compress
    delaycompress
    rotate 365
}

$ logrotate  -d /etc/logrotate.d/test
reading config file /etc/logrotate.d/test

Handling 2 logs

rotating pattern: /home/myapp/log/*.log
/home/myapp/log/*/*.log
 after 1 days (40 rotations)
empty log files are not rotated, old logs are removed
No logs found. Rotation not needed.

rotating pattern: /home/myapp/log/access/*.log  after 1 days (365 rotations)
empty log files are not rotated, old logs are removed
No logs found. Rotation not needed.

While when tested on my local logrotate (version 3.7.8) the error was raised:

$ cat logr.conf 
# rotate application logs for 40 days by default
/home/myapp/log/*.log
/home/myapp/log/*/*.log
{
    daily
    compress
    delaycompress
    rotate 40
}

# rotate access logs for 1 year
/home/myapp/log/access/*.log {
    daily
    compress
    delaycompress
    rotate 365
}

$ logrotate -d logr.conf 
reading config file logr.conf
reading config info for /home/myapp/log/*.log
/home/myapp/log/*/*.log

error: logr.conf:12 duplicate log entry for /home/myapp/log/access/api_access.log
error: found error in /home/myapp/log/access/*.log , skipping
removing last 1 log configs

...

Very nice. I want to emphasize one thing because it's a bit counter-intuitive: the man page states: "later definitions override earlier ones." Your example is correct; I'm just saying this because I had expected the opposite would have been the case. — drumfire, Jul 18 '20 at 21:59
This doesn't work for me using `logrotate 3.13.0` distributed as an alpine package. Different implementation perhaps... — helvete, Oct 09 '20 at 12:06

score 2 · Answer 3 · edited Feb 25 '18 at 20:31

If you know the names of all logs, you could also specify them together in one rule:

/var/log/mylogs/{file1,file2,file3,file4,file5}.log {
    size 1000k
    copytruncate
    create 0644 root root
    rotate 99
    compress
    missingok
}

/var/log/mylogs/thatonespecial.log {
    size 1000k
    copytruncate
    create 0644 myuser mygroup
    rotate 99
    compress
    missingok
}

How to specify exceptions from wildcard settings in a logrotate configuration file?

3 Answers3