# logrotate: correctly named old file exists suff to rotate?

## jeffk

Is the existence of a filename logrotate's only heuristic, or will it look at file ctimes, and/or is it keeping a datastore of logs somewhere?

I have configured syslog-ng to use /var/log/mail.log separate from /var/log/messages for my postfix logging.

I manually extracted the previous four mail.log-DATE.gz from messages-DATE.gz via grep, i.e. mail.log-DATE.gz are synthetic.

```
# ls -lh /var/log/{mail.log,messages}*

-rw------- 1 root root 671M Jul 12 13:01 /var/log/mail.log

-rw------- 1 root root  59M Jul 12 11:18 /var/log/mail.log-20100616.gz

-rw------- 1 root root  48M Jul 12 11:00 /var/log/mail.log-20100623.gz

-rw------- 1 root root  52M Jul 12 10:55 /var/log/mail.log-20100630.gz

-rw------- 1 root root  54M Jul 12 10:47 /var/log/mail.log-20100707.gz

-rw------- 1 root root 1.6M Jul 12 13:00 /var/log/messages

-rw------- 1 root root 117K Jul 12 11:24 /var/log/messages-20100616.gz

-rw------- 1 root root 481K Jul 12 11:01 /var/log/messages-20100623.gz

-rw------- 1 root root 351K Jul 12 10:56 /var/log/messages-20100630.gz

-rw------- 1 root root 197K Jul 12 10:47 /var/log/messages-20100707.gz
```

The next weekly logrotate for messages is due in two days. Will the presence of correctly named files be sufficient for logrotate to continue the sequence? 

Thanks.

----------

## dermund

Hi jeffk,

 *jeffk wrote:*   

> The next weekly logrotate for messages is due in two days. Will the presence of correctly named files be sufficient for logrotate to continue the sequence? 

 

That depends on your logrotate config file for that logfile imho. Can you post it?

----------

## jeffk

syslog-ng messages did get rotated on schedule. syslog-ng mail.log did not get rotated this morning as I hoped it would:

```
# ls -l /var/log/{messages,mail.log}*

-rw------- 1 root root 718944416 Jul 14 18:20 /var/log/mail.log

-rw------- 1 root root  61376365 Jul 12 11:18 /var/log/mail.log-20100616.gz

-rw------- 1 root root  49910765 Jul 12 11:00 /var/log/mail.log-20100623.gz

-rw------- 1 root root  53696645 Jul 12 10:55 /var/log/mail.log-20100630.gz

-rw------- 1 root root  56039113 Jul 12 10:47 /var/log/mail.log-20100707.gz

-rw------- 1 root root    537256 Jul 14 18:20 /var/log/messages

-rw------- 1 root root    492386 Jul 12 11:01 /var/log/messages-20100623.gz

-rw------- 1 root root    359303 Jul 12 10:56 /var/log/messages-20100630.gz

-rw------- 1 root root    201474 Jul 12 10:47 /var/log/messages-20100707.gz

-rw------- 1 root root    199323 Jul 14 03:10 /var/log/messages-20100714.gz
```

The logrotate config for syslog-ng is:

```
 # cat /etc/logrotate.d/syslog-ng 

# $Header: /var/cvsroot/gentoo-x86/app-admin/syslog-ng/files/syslog-ng.logrotate,v 1.3 2008/10/15 20:46:12 mr_bones_ Exp $

#

# Syslog-ng logrotate snippet for Gentoo Linux

# contributed by Michael Sterrett

#

/var/log/messages {

    missingok

    sharedscripts

    postrotate

        /etc/init.d/syslog-ng reload > /dev/null 2>&1 || true

    endscript

}

/var/log/mail.log {

    missingok

    rotate 8

    sharedscripts

    postrotate

        /etc/init.d/syslog-ng reload > /dev/null 2>&1 || true

    endscript

}
```

Would there be a problem with two definitions in one logrotate.d included file? It doesn't seem like that should be a problem.

Logrotate.conf is stock:

```
# cat /etc/logrotate.conf 

# $Header: /var/cvsroot/gentoo-x86/app-admin/logrotate/files/logrotate.conf,v 1.3 2008/12/24 20:49:10 dang Exp $

#

# Logrotate default configuration file for Gentoo Linux

#

# See "man logrotate" for details

# rotate log files weekly

weekly

#daily

# keep 4 weeks worth of backlogs

rotate 4

# create new (empty) log files after rotating old ones

create

# use date as a suffix of the rotated file

dateext

# uncomment this if you want your log files compressed

compress

# packages can drop log rotation information into this directory

include /etc/logrotate.d

notifempty

nomail

noolddir

# no packages own lastlog or wtmp -- we'll rotate them here

/var/log/wtmp {

    monthly

    create 0664 root utmp

    rotate 1

}

/var/log/btmp {

    missingok

    monthly

    create 0600 root utmp

    rotate 1

}

# system-specific logs may be also be configured here.
```

Thanks.

----------

## dermund

 *jeffk wrote:*   

> Would there be a problem with two definitions in one logrotate.d included file? It doesn't seem like that should be a problem. 

 

No - should not be a problem, but I think 

```
sharedscripts 
```

 is inappropriate because it should only be applied if multiple scripts are matched by the initial line. So I would test without it first.

Besides the config files look good to me... Strange.

You could do a 

```
logrotate -d
```

 to do a run in debug mode - it writes no changes. This should show you how logrotate is "considering" your log files.

----------

## jeffk

Hmm with the current config (tried verbatim and removing sharedscripts directive), logrotate -d still doesn't think /var/log/mail.log needs to be rotated:

```
# /usr/sbin/logrotate -d /etc/logrotate.conf

reading config file /etc/logrotate.conf

including /etc/logrotate.d

reading config file apache2

reading config info for /var/log/apache2/*log 

reading config file clamav

reading config info for /var/log/clamav/clamd.log 

reading config info for /var/log/clamav/freshclam.log 

reading config file dovecot

reading config info for /var/log/dovecot*.log 

reading config file elog-save-summary

reading config info for /var/log/portage/elog/summary.log 

reading config file mailgraph

reading config info for /var/log/mailgraph/mailgraph.log 

compress_prog is now /bin/gzip

compress_options is now -9

uncompress_prog is now /bin/gunzip

reading config file openrc

reading config info for /var/log/rc.log 

reading config file rsyncd

reading config info for /var/log/rsync.log 

reading config file syslog-ng

reading config info for /var/log/messages 

reading config info for /var/log/mail.log 

reading config info for /var/log/wtmp 

reading config info for /var/log/btmp 

Handling 12 logs

rotating pattern: /var/log/apache2/*log  weekly (4 rotations)

empty log files are not rotated, old logs are removed

considering log /var/log/apache2/access_log

  log does not need rotating

considering log /var/log/apache2/error_log

  log does not need rotating

considering log /var/log/apache2/ssl_access_log

  log does not need rotating

considering log /var/log/apache2/ssl_error_log

  log does not need rotating

considering log /var/log/apache2/ssl_request_log

  log does not need rotating

not running postrotate script, since no logs were rotated

rotating pattern: /var/log/clamav/clamd.log  weekly (4 rotations)

empty log files are rotated, old logs are removed

considering log /var/log/clamav/clamd.log

  log /var/log/clamav/clamd.log does not exist -- skipping

not running postrotate script, since no logs were rotated

rotating pattern: /var/log/clamav/freshclam.log  weekly (4 rotations)

empty log files are rotated, old logs are removed

considering log /var/log/clamav/freshclam.log

  log /var/log/clamav/freshclam.log does not exist -- skipping

not running postrotate script, since no logs were rotated

rotating pattern: /var/log/dovecot*.log  weekly (8 rotations)

empty log files are not rotated, old logs are removed

considering log /var/log/dovecot.log

  log does not need rotating

not running postrotate script, since no logs were rotated

rotating pattern: /var/log/portage/elog/summary.log  weekly (4 rotations)

empty log files are rotated, old logs are removed

considering log /var/log/portage/elog/summary.log

  log does not need rotating

rotating pattern: /var/log/mailgraph/mailgraph.log  after 1 days (30 rotations)

empty log files are rotated, old logs are removed

considering log /var/log/mailgraph/mailgraph.log

  log needs rotating

rotating log /var/log/mailgraph/mailgraph.log, log->rotateCount is 30

dateext suffix '-20100715'

glob pattern '-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]'

glob finding logs to compress failed

glob finding old rotated logs failed

renaming /var/log/mailgraph/mailgraph.log to /var/log/mailgraph/mailgraph.log-20100715

creating new /var/log/mailgraph/mailgraph.log mode = 0644 uid = 104 gid = 4

running postrotate script

running script with arg /var/log/mailgraph/mailgraph.log : "

      /etc/init.d/mailgraph restart >/dev/null

"

rotating pattern: /var/log/rc.log  weekly (4 rotations)

empty log files are not rotated, old logs are removed

considering log /var/log/rc.log

  log /var/log/rc.log does not exist -- skipping

rotating pattern: /var/log/rsync.log  1048576 bytes (7 rotations)

empty log files are not rotated, old logs are removed

considering log /var/log/rsync.log

  log /var/log/rsync.log does not exist -- skipping

rotating pattern: /var/log/messages  weekly (4 rotations)

empty log files are rotated, old logs are removed

considering log /var/log/messages

  log does not need rotating

not running postrotate script, since no logs were rotated

rotating pattern: /var/log/mail.log  weekly (8 rotations)

empty log files are rotated, old logs are removed

considering log /var/log/mail.log

  log does not need rotating

not running postrotate script, since no logs were rotated

rotating pattern: /var/log/wtmp  monthly (1 rotations)

empty log files are not rotated, old logs are removed

considering log /var/log/wtmp

  log does not need rotating

rotating pattern: /var/log/btmp  monthly (1 rotations)

empty log files are not rotated, old logs are removed

considering log /var/log/btmp

  log /var/log/btmp does not exist -- skipping
```

----------

## jeffk

I decided to force the rotation for /var/log/mail.log. This is a new file which has never been rotated by logrotate. There's some logrotate state file which I don't know the location of, so this might help it learn about the new file for the next scheduled rotation:

```
# cat /etc/logrotate.conf /etc/logrotate.d/syslog-ng > /etc/logrotate.d/forcemaillog  

# nano -w /etc/logrotate.d/forcemaillog   (edit to the following form)

logrotate.d # cat /etc/logrotate.d/forcemaillog

/var/log/mail.log {

weekly

create

dateext

compress

notifempty

nomail

noolddir

    missingok

    rotate 8

    sharedscripts

    postrotate

        /etc/init.d/syslog-ng reload > /dev/null 2>&1 || true

    endscript

}

# /usr/sbin/logrotate -d /etc/logrotate.d/forcemaillog

reading config file /etc/logrotate.d/forcemaillog

reading config info for /var/log/mail.log 

Handling 1 logs

rotating pattern: /var/log/mail.log  weekly (8 rotations)

empty log files are not rotated, old logs are removed

considering log /var/log/mail.log

  log does not need rotating

not running postrotate script, since no logs were rotated

# /usr/sbin/logrotate -d -f /etc/logrotate.d/forcemaillog

reading config file /etc/logrotate.d/forcemaillog

reading config info for /var/log/mail.log 

Handling 1 logs

rotating pattern: /var/log/mail.log  forced from command line (8 rotations)

empty log files are not rotated, old logs are removed

considering log /var/log/mail.log

  log needs rotating

rotating log /var/log/mail.log, log->rotateCount is 8

dateext suffix '-20100715'

glob pattern '-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]'

renaming /var/log/mail.log to /var/log/mail.log-20100715

creating new /var/log/mail.log mode = 0644 uid = 0 gid = 0

running postrotate script

running script with arg /var/log/mail.log : "

        /etc/init.d/syslog-ng reload > /dev/null 2>&1 || true

"

compressing log with: /bin/gzip

# ls -l /var/log/mail.log*

-rw------- 1 root root     5774 Jul 15 12:27 /var/log/mail.log

-rw-r--r-- 1 root root 61376365 Jul 12 11:18 /var/log/mail.log-20100616.gz

-rw-r--r-- 1 root root 49910765 Jul 12 11:00 /var/log/mail.log-20100623.gz

-rw-r--r-- 1 root root 53696645 Jul 12 10:55 /var/log/mail.log-20100630.gz

-rw-r--r-- 1 root root 56039113 Jul 12 10:47 /var/log/mail.log-20100707.gz

-rw-r--r-- 1 root root 43617534 Jul 15 12:27 /var/log/mail.log-20100715.gz
```

----------

## dermund

Yea, that should do it  :Very Happy: 

The manpage could be a little more detailed about the state file, thou...

----------

