1

I have a server collecting syslog messages from the network. Logrotate is currently setup and working, and the config looks like such:

/logs/*/log {
    daily
    rotate 60
}

Instead of rotating daily, I'd like weekly. Obviously, I'm keeping 60 days' logs, so I would likely be changing the rotate 60 to rotate 8, which would keep 8 weeks' logs.

My questions are these:

  1. If I change from daily to weekly and keep 8 logs, when logrotate runs will it delete the 52 oldest daily logs, or is it smart enough to notice the date stamps on the files, and realize that 8 weeks’ time is 2 months ago?
  2. If I run logrotate manually with the -f flag to force rotation, and I did this 8 times, would I effectively wipe all logs completely?
  3. If I go into the logrotate.status file and manually remove one particular log, what will happen to that particular log when logrotate runs next?
user3629081
  • 253
  • 1
  • 5

1 Answers1

1
  1. If you change the number of logs, then at the next run logrotate will ensure that at most that many logs are kept. The number is not necessarily related to number of days (you could run logrotate hourly if you configure it correctly).
  2. Yes, unless you have the notifempty setting (which I do recommend).
  3. Same as if you re-added that log to the configuration after having removed it. It will rotate the log as it doesn't know when that might have been done previously, and it will preserve the required number of logs as per point 1.
wurtel
  • 3,806
  • 12
  • 15