how does logrotate actually works

Question

I am trying to the setup log for the httpd server then I write a script in /etc/logrotate.d/apache.conf

/var/log/httpd/* {
    daily
    rotate 3
    size 20K
    compress
    delaycompress
}

what I understood from this file

/var/log/httpd/* = where all the logs the stored and you want to logrotate them

daily = when you want to rotate the log

rotate= only 3 rotated logs should be kept

size = when your log file size meet with this condition

compress= make a zip file of rotated logs

delaycompress = kind of compress don't know much

so I hit to apache server that generates a lot of logs

after the log generated

where is my log are store how it is run only on when size condition matches or else thanks for any guidance or help

one more thing when and how log rotate run why some people suggested to use cron job with logrotate

Please [edit] your question and copy&paste the commands and output **as text** formattes as code blocks instead of showing screenshots. Is the error message about the missing file `access_log.4.gz` the last output? If not, show the missing output. Please also show the resulting file after you ran `logrotate`. Please edit your question to answer, don't use comments for this purpose. — Bodo, Aug 10 '21 at 08:15

score 1 · Accepted Answer · answered Aug 12 '21 at 22:24

where is my log are store

Unless you specify the olddir directive, they are rotated within the same directory that they exist.

how it is run only on when size condition matches or else

If you specify the size directive, logs are only rotated if they are larger than that size:

size size

Log files are rotated only if they grow bigger then size bytes.

Files that do not meet the size requirement are ignored (https://linux.die.net/man/8/logrotate).

why some people suggested to use cron job with logrotate

logrotate is just an executable; it does not handle any facet of how or when it is executed. cron is typically how logrotate's execution is scheduled. For example, on CentOS, inside the /etc/cron.daily directory is an executable shell script:

#!/bin/sh

/usr/sbin/logrotate -s /var/lib/logrotate/logrotate.status /etc/logrotate.conf
EXITVALUE=$?
if [ $EXITVALUE != 0 ]; then
    /usr/bin/logger -t logrotate "ALERT exited abnormally with [$EXITVALUE]"
fi
exit 0

This script is executed one per day by cron and is how logrotate's execution is actually initiated.

Couple other problems:

/var/log/httpd/* - Unless you're rotating files out of the original directory with the olddir directive, never end your logrotate's directory definition with a wildcard (*). This definition is going to glom on to every file in that directory, including the files that you've already rotated. Logrotate has no way of keeping track of what files are actual logs and which are stored rotations. Your directory definition should be something like /var/log/httpd/*_log instead.
You should be reloading httpd after you rotate the log files, else it will probably continue to log into the rotated file because you never closed its handle.
```
 sharedscripts
 postrotate
     /bin/systemctl reload httpd.service > /dev/null 2>/dev/null || true
 endscript
```

Again this is a CentOS-specific example.

how does logrotate actually works

1 Answers1