37

Judging by the timestamps on my systems, logrotate does its daily log rotation when logrotate is run by cron. However, if I run it earlier than that it doesn't rotate the files. How does logrotate know if should rotate them or not, does it keep a history or perhaps use timestamps?

Kyle Brandt
  • 82,107
  • 71
  • 302
  • 444

3 Answers3

39

I believe it's the content of the state file, which is my case is /var/lib/logrotate.status. Each file has one line, which is the date on which it was last rotated; if you run logrotate on such a date that a given file is due for rotation, given the number of days between current date and the date in the file (1 for daily, 7 for weekly, etc.), the file will be rotated.

logrotate doesn't seem to care at what time of day it's run; even if it usually runs at 2355, if you were to run it at 0130 instead, it would still rotate files marked daily and last done yesterday; but having done so it would put today's date into the state file (against any rotated files), so a second run at 2355 would do nothing.

MadHatter
  • 78,442
  • 20
  • 178
  • 229
  • 4
    Hmm.. So it only rotates if: current date > date in `/var/lib/logrotate/status` (as the file is in my case). – Kyle Brandt Nov 04 '10 at 14:28
  • 3
    I think it only does anything at all if 24 hours have passed since it was last run, which it works out by examining the mtime of the state file. Once it's decided a whole day has passed and it may lawfully do anything at all, it makes DAILY, WEEKLY etc. decisions based on the date fields inside the file. – MadHatter Nov 04 '10 at 14:30
  • 5
    Well it seems to use the date in that file. I set the day one day back in the status file and ran it ... it rotated .. – Kyle Brandt Nov 04 '10 at 14:48
  • 1
    Having just gone back and poked my logrotate, I think I was wrong and what you write above is right. It decides if it's already been run today by looking at the timestamp of the state file; if it hasn't, it proceeds to extract the dates of last rotation from the state file, and acts accordingly. I just lied to logrotate with vi and touch -t to persuade it that it last ran at 2355 yesterday, when it rotated my munin logs. Running it again, even though it's been less than 24 hours, it rotated them out and updated the state file accordingly. – MadHatter Nov 04 '10 at 14:50
  • I've updated my answer to my current understanding, given the set of tests I've just run (slicing my munin logs eight ways from sunday, but who cares!). – MadHatter Nov 04 '10 at 14:57
  • You can use the `-f` option to force logrotate to run even if it thinks it has already done its thing for today. (You also can put a config file at the end of the command, which leads to `logrotate -f /etc/foo.conf` having non-obvious meaning for those of us used to "-f" meaning "use this config file".) – Dan Pritts Sep 16 '19 at 20:21
12

From the logrotate man page:

Normally, logrotate is run as a daily cron job. It will not modify a log more than once in one day unless the criterion for that log is based on the log's size and logrotate is being run more than once each day, or unless the -f or -force option is used.

sebthebert
  • 1,224
  • 8
  • 21
1

It runs on crontab schedules. You just need to find which crontab schedule has logrotate configured. Normally, it's in the daily /etc/cron.daily/. The generic crontab schedules are available in /etc/crontab.

Sample below:

# run-parts
01 * * * * root run-parts /etc/cron.hourly
02 4 * * * root run-parts /etc/cron.daily
22 4 * * 0 root run-parts /etc/cron.weekly
42 4 1 * * root run-parts /etc/cron.monthly```
mforsetti
  • 2,488
  • 2
  • 14
  • 20
Sambhu Sasidharan
  • 11
  • 1