16

My current logrotate configuration looks like this (using logrotate 3.8.7)

"/var/log/haproxy.log" {
  daily
  size 250M
  rotate 1
  create 644 root root
  missingok
  compress
  notifempty
  copytruncate
}

It successfully runs once a day, but when size exceeds 250M it doesn't get rotated. So it waits until the end of the day to rotate, regardless of size.

I've read that there is the maxsize option, and after changing size 250M to maxsize 250M it still doesn't work.

Do I need to set a cron to run logrotate in an hourly manner, or logrotate gets run automatically because is listening to that file size, and I have something else wrong going on?

Hommer Smith
  • 273
  • 1
  • 3
  • 6

1 Answers1

15

Yes, you need to run logrotate more than once a day to achieve this. This is answered in the seconds paragraph of the man page logrotate(8):

Normally, logrotate is run as a daily cron job. It will not modify a log multiple times in one day unless the criterion for that log is based on the log's size and logrotate is being run multiple times each day, or unless the -f or --force option is used.

If you would like to run logrotate hourly instead of daily, you can move it:

mv /etc/cron.daily/logrotate /etc/cron.hourly

Since 3.8.1 there has been maxsize. The difference between size and maxsize is described here:

maxsize size

Log files are rotated when they grow bigger than size bytes even before the additionally specified time interval (daily, weekly, monthly, or yearly). The related size option is similar except that it is mutually exclusive with the time interval options, and it causes log files to be rotated without regard for the last rotation time. When maxsize is used, both the size and timestamp of a log file are considered.

This would make both suitable for your use: size without any interval and maxsize if also interval is needed. However, this doesn't change the fact that by default logrotate runs only daily. That interval is suitable for most, as in most cases it takes a lot longer than a day for a log to grow over 250M.

Esa Jokinen
  • 46,944
  • 3
  • 83
  • 129
  • 1
    FYI there is a maxsize directive, starting from 8.1: ftp://hpux.connect.org.uk/hpux/Sysadmin/logrotate-3.8.7/logrotate-3.8.7.man.html – Hommer Smith May 19 '17 at 07:03
  • Thanks for noticing I was reading an ancient version of the manual, @HommerSmith! I corrected my answer accordingly. – Esa Jokinen May 19 '17 at 07:53
  • 1
    Note that the `logrotate` `cron` script originally found in `/etc/cron.daily/logrotate` may contain the following lines: `# skip in favour of systemd timer`, `if [ -d /run/systemd/system ]; then`, `exit 0`, `fi`. If it does, and `/run/systemd/system` is a directory on your system, then you need to comment out/delete those lines, otherwise moving `/etc/cron.daily/logrotate` to `/etc/cron.hourly` isn't going to make any difference. See [this answer](https://stackoverflow.com/a/69465677/8477566) for more information – Jake Levi Oct 25 '21 at 12:01