Logrotate not rotating old files even after rotate is set to 0

Question

In my log rotate setup, for a specific log file the rotate has been set to 0. But once the size of the file is reached, the old file is rotated to application.log.1 instead of being deleted.

As per the documentation, the file should be deleted when rotate is set to 0. Why is this happening? I must also say that log rotate is configured to run every hour, but our log file reaches the size within 1 hour. So when logrotate runs every hour, it deletes the old application.log.1, rolls over the current application.log to application.log.1 and creates a new application.log file. The config for the file looks like below:

/var/log/application.log
{
    rotate 0
    weekly
    size 256M
    missingok
    notifempty
    copytruncate
    compress
    delaycompress
    sharedscripts
    postrotate
            reload rsyslog >/dev/null 2>&1 || true
            /usr/sbin/scalyr-agent-2 stop
            /usr/sbin/scalyr-agent-2 start
    endscript
}

score 1 · Answer 1 · answered Nov 14 '17 at 14:37

It looks like both copytruncate and delaycompress cause new files to be created, despite the rotate 0 setting. Since you want to delete old files immediately (why not just log to /dev/null directly in the first place?), you don't need any compress settings anyway.

I see two options:

If you really need copytruncate, add a postrotate command to delete the created file:

/var/log/application.log {
    rotate 0
    size 256M
    missingok
    notifempty
    copytruncate
    postrotate
        reload rsyslog >/dev/null 2>&1 || true
        /usr/sbin/scalyr-agent-2 stop
        /usr/sbin/scalyr-agent-2 start
        rm -f /var/log/application.log.1
    endscript
}

If you don't need copytruncate, replaced it with create (if at all, maybe your service creates a new log file on its own):

/var/log/application.log {
    rotate 0
    size 256M
    missingok
    notifempty
    create
    postrotate
        reload rsyslog >/dev/null 2>&1 || true
        /usr/sbin/scalyr-agent-2 stop
        /usr/sbin/scalyr-agent-2 start
    endscript
}

Add owner and permission as needed to the create command.

I also did the following:

Remove weekly: frequencies and size are mutually exclusive
Remove the compress and delaycompress commands: you want to delete your old files, so why bother with compressing in the first place?

But, as pointed out above, it looks like you don't want the logs in the first place, so try preventing the application from writing them, or redirect to /dev/null, if you really don't need them.

Side note: your description of what's happening is not quite accurate because of the copytruncate setting: the logfile is never deleted, only copied, then truncated in place. This is used for programs that can't change the file handle they're writing to.

"why not just log to /dev/null directly in the first place?" because you want to keep the most recent logs, but don't need to keep old logs. In particular you may want to watch the logs with `tail -f` while something is happening but don't need historical logs. — Thayne, Jan 19 '18 at 22:52

Logrotate not rotating old files even after rotate is set to 0

1 Answers1