3

I created a log-rotate option for our docker logs and it is working fine. Here is the configuration file

*root@aerogear:/var/lib/docker/containers/b8da13f8dc6cb642959103c23db2a02ef2c7291ae5f94625a92ac9329db1647e# cat /etc/logrotate.d/docker-container
/var/lib/docker/containers/*/*.log {
  rotate 7
  hourly
  compress
  size=100M
  missingok
  delaycompress
  copytruncate
}*

It seems that hourly logrotate is working fine. But because of some error, this log file was increased up to 18G, because the size=100M rule didn't work in that case. Do you know any specific reason for that?

Ronan Boiteau
  • 9,608
  • 6
  • 34
  • 56
Roni Baby
  • 91
  • 1
  • 10

2 Answers2

6
  • There shouldn't be an equal sign after size.
  • If you want to rotate both hourly and when the file grows bigger than 100M, then you should use maxsize instead of size.

So you should try maxsize 100M instead of size=100M.

Ronan Boiteau
  • 9,608
  • 6
  • 34
  • 56
6

As mentioned by Ronan, size and hourly are "contradictory". One or the other may be used, but it is likely that one has priority, so you need to use maxsize instead.

Next:

Normally, logrotate is run as a daily cron job. It will not modify a log more than once in one day unless the criterion for that log is based on the log's size and logrotate is being run more than once each day, or unless the -f or --force option is used.

(from logrotate manual page)

On a standard Ubuntu installation, logrotate runs once per day. If you look at the cron installation, you will see logrotate under the cron.daily directory:

prompt$ ls -l /var/cron.daily
...
-rwxr-xr-x 1 root root  372 May  6  2015 logrotate
...

And there is nothing under cron.hourly:

prompt$ ls -l /var/cron.hourly
(nothing)

This shows that an hourly setup for logrotate is not going to be responding any more than a daily setup on a default setup. Of course, you can change that and get logrotate to run once an hour or even once a minute (in this last case, you need a crontab for root). But by default a maxsize with an hourly or daily setup is not useful since the file will be rotated each time anyway, whatever the size.

Also there has been versions of logrotate where the maxsize parameter did not work. This should not be an issue in the newer versions.

And as Ronan mentioned, no = sign between the option and value.

Alexis Wilke
  • 19,179
  • 10
  • 84
  • 156
  • Why will the hourly setup for logrotate not respond any more than a daily setup? What if we move the logrotate script to /cron.hourly ? – Ryan w Jan 12 '22 at 13:54
  • @Ryanw Yes. I mentioned you could move the script to run hourly or even once a minute. To get a minute run, you need to move the script somewhere else (may `/root`) and use the root `crontab` for that purpose, but if you have many logs that is likely going to be way too much--a huge I/O hog. – Alexis Wilke Jan 12 '22 at 16:57
  • Do you know why the max size will not work with an hourly setup? – Ryan w Jan 12 '22 at 17:16
  • @Ryanw I made an update to my answer. I think it will be easier to understand. If you use `hourly` and run logrotate every hour, then the files will be rotate every hour, whatever the size. So having that parameter won't help (it's just noise). – Alexis Wilke Jan 12 '22 at 22:42