Logrotate not compressing

Question

We have syslogd set up to send all logs from a few different servers into one, all into a folder called /var/log/centrallogs.

We're using the following log rotate config for this directory:

/etc/logrotate.d/centrallogs:

/var/log/centrallogs/*log {
        rotate 5
        compress
        missingok
        notifempty
        sharedscripts
        postrotate
        /etc/init.d/httpd restart > /dev/null 2>/dev/null || true
        endscript
}

In testing (using logrotate -d centrallogs) LR doesn't appear to try to do any rotating.

Here's the output (Note, I've renamed the sites, however that's the only change I've made):

rotating pattern: /var/log/centrallogs/*log  1048576 bytes (5 rotations)
empty log files are not rotated, old logs are removed
considering log /var/log/centrallogs/site1_access.log
  log needs rotating
considering log /var/log/centrallogs/site1_error.log
  log does not need rotating
considering log /var/log/centrallogs/site2_access.log
  log needs rotating
considering log /var/log/centrallogs/site2_error.log
  log needs rotating
considering log /var/log/centrallogs/site3_access.log
  log needs rotating
considering log /var/log/centrallogs/site3_error.log
  log needs rotating
rotating log /var/log/centrallogs/site1_access.log, log->rotateCount is 5
dateext suffix '-20150908'
glob pattern '-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]'
renaming /var/log/centrallogs/site1_access.log.5.gz to /var/log/centrallogs/site1_access.log.6.gz (rotatecount 5, logstart 1, i 5), 
renaming /var/log/centrallogs/site1_access.log.4.gz to /var/log/centrallogs/site1_access.log.5.gz (rotatecount 5, logstart 1, i 4), 
renaming /var/log/centrallogs/site1_access.log.3.gz to /var/log/centrallogs/site1_access.log.4.gz (rotatecount 5, logstart 1, i 3), 
renaming /var/log/centrallogs/site1_access.log.2.gz to /var/log/centrallogs/site1_access.log.3.gz (rotatecount 5, logstart 1, i 2), 
renaming /var/log/centrallogs/site1_access.log.1.gz to /var/log/centrallogs/site1_access.log.2.gz (rotatecount 5, logstart 1, i 1), 
renaming /var/log/centrallogs/site1_access.log.0.gz to /var/log/centrallogs/site1_access.log.1.gz (rotatecount 5, logstart 1, i 0), 
rotating log /var/log/centrallogs/site2_access.log, log->rotateCount is 5
dateext suffix '-20150908'
glob pattern '-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]'
renaming /var/log/centrallogs/site2_access.log.5.gz to /var/log/centrallogs/site2_access.log.6.gz (rotatecount 5, logstart 1, i 5), 
renaming /var/log/centrallogs/site2_access.log.4.gz to /var/log/centrallogs/site2_access.log.5.gz (rotatecount 5, logstart 1, i 4), 
renaming /var/log/centrallogs/site2_access.log.3.gz to /var/log/centrallogs/site2_access.log.4.gz (rotatecount 5, logstart 1, i 3), 
renaming /var/log/centrallogs/site2_access.log.2.gz to /var/log/centrallogs/site2_access.log.3.gz (rotatecount 5, logstart 1, i 2), 
renaming /var/log/centrallogs/site2_access.log.1.gz to /var/log/centrallogs/site2_access.log.2.gz (rotatecount 5, logstart 1, i 1), 
renaming /var/log/centrallogs/site2_access.log.0.gz to /var/log/centrallogs/site2_access.log.1.gz (rotatecount 5, logstart 1, i 0), 
rotating log /var/log/centrallogs/site2_error.log, log->rotateCount is 5
dateext suffix '-20150908'
glob pattern '-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]'
renaming /var/log/centrallogs/site2_error.log.5.gz to /var/log/centrallogs/site2_error.log.6.gz (rotatecount 5, logstart 1, i 5), 
renaming /var/log/centrallogs/site2_error.log.4.gz to /var/log/centrallogs/site2_error.log.5.gz (rotatecount 5, logstart 1, i 4), 
renaming /var/log/centrallogs/site2_error.log.3.gz to /var/log/centrallogs/site2_error.log.4.gz (rotatecount 5, logstart 1, i 3), 
renaming /var/log/centrallogs/site2_error.log.2.gz to /var/log/centrallogs/site2_error.log.3.gz (rotatecount 5, logstart 1, i 2), 
renaming /var/log/centrallogs/site2_error.log.1.gz to /var/log/centrallogs/site2_error.log.2.gz (rotatecount 5, logstart 1, i 1), 
renaming /var/log/centrallogs/site2_error.log.0.gz to /var/log/centrallogs/site2_error.log.1.gz (rotatecount 5, logstart 1, i 0), 
rotating log /var/log/centrallogs/site3_access.log, log->rotateCount is 5
dateext suffix '-20150908'
glob pattern '-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]'
renaming /var/log/centrallogs/site3_access.log.5.gz to /var/log/centrallogs/site3_access.log.6.gz (rotatecount 5, logstart 1, i 5), 
renaming /var/log/centrallogs/site3_access.log.4.gz to /var/log/centrallogs/site3_access.log.5.gz (rotatecount 5, logstart 1, i 4), 
renaming /var/log/centrallogs/site3_access.log.3.gz to /var/log/centrallogs/site3_access.log.4.gz (rotatecount 5, logstart 1, i 3), 
renaming /var/log/centrallogs/site3_access.log.2.gz to /var/log/centrallogs/site3_access.log.3.gz (rotatecount 5, logstart 1, i 2), 
renaming /var/log/centrallogs/site3_access.log.1.gz to /var/log/centrallogs/site3_access.log.2.gz (rotatecount 5, logstart 1, i 1), 
renaming /var/log/centrallogs/site3_access.log.0.gz to /var/log/centrallogs/site3_access.log.1.gz (rotatecount 5, logstart 1, i 0), 
rotating log /var/log/centrallogs/site3_error.log, log->rotateCount is 5
dateext suffix '-20150908'
glob pattern '-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]'
renaming /var/log/centrallogs/site3_error.log.5.gz to /var/log/centrallogs/site3_error.log.6.gz (rotatecount 5, logstart 1, i 5), 
renaming /var/log/centrallogs/site3_error.log.4.gz to /var/log/centrallogs/site3_error.log.5.gz (rotatecount 5, logstart 1, i 4), 
renaming /var/log/centrallogs/site3_error.log.3.gz to /var/log/centrallogs/site3_error.log.4.gz (rotatecount 5, logstart 1, i 3), 
renaming /var/log/centrallogs/site3_error.log.2.gz to /var/log/centrallogs/site3_error.log.3.gz (rotatecount 5, logstart 1, i 2), 
renaming /var/log/centrallogs/site3_error.log.1.gz to /var/log/centrallogs/site3_error.log.2.gz (rotatecount 5, logstart 1, i 1), 
renaming /var/log/centrallogs/site3_error.log.0.gz to /var/log/centrallogs/site3_error.log.1.gz (rotatecount 5, logstart 1, i 0), 
renaming /var/log/centrallogs/site1_access.log to /var/log/centrallogs/site1_access.log.1
renaming /var/log/centrallogs/site2_access.log to /var/log/centrallogs/site2_access.log.1
renaming /var/log/centrallogs/site2_error.log to /var/log/centrallogs/site2_error.log.1
renaming /var/log/centrallogs/site3_access.log to /var/log/centrallogs/site3_access.log.1
renaming /var/log/centrallogs/site3_error.log to /var/log/centrallogs/site3_error.log.1
running postrotate script
running script with arg /var/log/centrallogs/*log : "
    /etc/init.d/httpd restart > /dev/null 2>/dev/null || true
"
compressing log with: /bin/gzip
removing old log /var/log/centrallogs/site1_access.log.6.gz
error: error opening /var/log/centrallogs/site1_access.log.6.gz: No such file or directory

I've tried using delaycompress too instead since some people have had success with that.

LR rotates the logs just fine, it just doesn't perform compression on them at all.

Looking at the only error-sounding part of that output:

error: error opening /var/log/centrallogs/site1_access.log.6.gz: No such file or directory

I figured LR might be freaking out because it didn't have a .gz file to remove, so I created every variation of log file needed, it ran over night, cleared out the gz's, rotated, but still didn't compress.

This is driving me a bit mad, any help would be gratefully received.

Maybe `delaycompress` will help: http://serverfault.com/a/117009/253150 — Samuel, Sep 09 '15 at 15:11
Hmm, it should compress with `gzip` by default. Can you check if your `gzip` is at `/bin/gzip`? — Samuel, Sep 09 '15 at 15:45
@Samuel it is by the looks of it: whereis gzip gzip: /bin/gzip /usr/bin/gzip /usr/share/man/man1/gzip.1.gz — Mike McCormick, Sep 09 '15 at 15:54
Ok another question. Why `/etc/init.d/httpd restart ` instead of `/sbin/service httpd reload`? — Samuel, Sep 09 '15 at 16:02
@Samuel That's a great question, I didn't write the original config, and I've been wondering the same, I'll speak to the tech who put it in, and let you know :) — Mike McCormick, Sep 09 '15 at 21:14

score 4 · Accepted Answer · answered Oct 14 '15 at 09:50

Based on the log, it looks like it's running /bin/gzip, and normally gzip will compress all listed files - skipping any that are were missing - with no trouble. Note that gzip will not forcibly compress files if the results are bigger, which can happen on very small files pretty easily. The "error: error [..]" message likely isn't from gzip, which tends to prefix errors with "gzip: :".

Check the file sizes to see if they're small (or more specifically, if gzip thinks compressing them will make them bigger).

Similar comments for notifempty.

The delaycompress just means you can have .1 .2 .3 .4.gz .5.gz and the like. It's not necessary to make compress work, and actually makes it skip compressing most recent few files. You'd use both, or just compress, not delaycompress by itself.

It's weird that you don't have a frequency/size { daily | weekly | size ___ } in your file. I've never tried to use them without one.

From the manpage of gzip-1.5-10.el7.x86_64: `Compression is always performed, even if the compressed file is slightly larger than the original. The worst case expansion is a few bytes for the gzip file header, plus 5 bytes every 32K block, or an expansion ratio of 0.015% for large files. Note that the actual number of used disk blocks almost never increases. gzip preserves the mode, ownership and timestamps of files when compressing or decompressing.` — lingfish, Mar 05 '20 at 02:31

score 0 · Answer 2 · answered Sep 09 '21 at 14:42

Responding specifically to your observation that the delay compress did not work - Please note that the delaycompress facility only compresses the previous log file in the next rotation cycle. As explained here in man logrotate

delaycompress
      Postpone compression of the previous log file to the next rotation cycle.  
      This only has effect when used in combination with compress.

score 0 · Answer 3 · edited Nov 05 '21 at 01:37

0

logrotate -fv /etc/logrotate.d/centrallogs

-f force rotation, -d debug mode only show more info, and -v verbose mode

edited Nov 05 '21 at 01:37

Nolequen

3,032
6
36
55

answered Nov 04 '21 at 07:04

mondrillo

1

Logrotate not compressing

3 Answers3