logrotate by size - do I need to change the cron?
My current logrotate configuration looks like this (using logrotate 3.8.7)
"/var/log/haproxy.log" {
daily
size 250M
rotate 1
create 644 root root
missingok
compress
notifempty
copytruncate
}
It successfully runs once a day, but when size exceeds 250M it doesn't get rotated. So it waits until the end of the day to rotate, regardless of size.
I've read that there is the maxsize option, and after changing size 250M
to maxsize 250M
it still doesn't work.
Do I need to set a cron to run logrotate in an hourly manner, or logrotate gets run automatically because is listening to that file size, and I have something else wrong going on?
Yes, you need to run logrotate
more than once a day to achieve this. This is answered in the seconds paragraph of the man page logrotate
(8):
Normally,
logrotate
is run as a daily cron job. It will not modify a log multiple times in one day unless the criterion for that log is based on the log's size andlogrotate
is being run multiple times each day, or unless the-f
or--force
option is used.
If you would like to run logrotate
hourly instead of daily, you can move it:
mv /etc/cron.daily/logrotate /etc/cron.hourly
Since 3.8.1 there has been maxsize
. The difference between size
and maxsize
is described here:
maxsize
sizeLog files are rotated when they grow bigger than size bytes even before the additionally specified time interval (
daily
,weekly
,monthly
, oryearly
). The relatedsize
option is similar except that it is mutually exclusive with the time interval options, and it causes log files to be rotated without regard for the last rotation time. Whenmaxsize
is used, both the size and timestamp of a log file are considered.
This would make both suitable for your use: size
without any interval and maxsize
if also interval is needed. However, this doesn't change the fact that by default logrotate
runs only daily. That interval is suitable for most, as in most cases it takes a lot longer than a day for a log to grow over 250M
.