All notes
Logrota

# Configuration


sharedscripts: the postrotate script will only be run once, not once for each log which is rotated.
notifempty: Do not rotate the log if it is empty (this overrides the ifempty option).



/var/log/warn /var/log/messages /var/log/allmessages /var/log/localmessages
/var/log/firewall /var/log/acpid /var/log/NetworkManager
/var/log/mail /var/log/mail.info /var/log/mail.warn /var/log/mail.err
/var/log/news/news.crit /var/log/news/news.err /var/log/news/news.notice
{
compress
dateext
maxage 365
rotate 99
missingok
notifempty
size +4096k
create 640 root root
sharedscripts
postrotate
endscript
}


## wildcards


/var/log/httpd/*.log /var/log/httpd/*/*.log {
# ... same as above
}


You can test your file without performing the actual rotations by doing this:


logrotate -d -f /etc/logrotate.conf
# -d = Turns on debug mode. In debug mode, no changes will be made to the logs or to the logrotate state file.
# -f = Tells logrotate to force the rotation, even if it doesn’t think this is necessary.


## daily

### How does logrotate handle daily

It uses the status file "/var/lib/logrotate.status", with content like:

"/var/log/dracut.log" 2016-12-8-2:0:0


From the logrotate man page:

Normally, logrotate is run as a daily cron job. It will not modify a log more than once in one day unless the criterion for that log is based on the log's size and logrotate is being run more than once each day, or unless the -f or -force option is used.


## dateext, dateformat



dateext
dateformat -%Y%m%d-%s

dateext: rotate by appending a date extension like YYYYMMDD. The extension may be configured using the "dateformat" and "dateyesterday" options.

dateformat format_string: Use the notation similar to strftime(3) function.
Only %Y %m %d and %s specifiers are allowed. The default value is -%Y%m%d. The system clock must be set past Sep 9th 2001 for %s to work correctly. %s: The number of seconds since the Epoch, 1970-01-01.
Note that also the character separating log name from the extension is part of the dateformat string.
Note that the datestamps generated by this format must be lexically sortable (i.e., first the year, then the month then the day. e.g., 2001/12/01 is ok, but 01/12/2001 is not, since 01/11/2002 would sort lower while it is later). This is because when using the rotate option, logrotate sorts all rotated filenames to find out which logfiles are older and should be removed.

dateyesterday: Use yesterday's instead of today's date to create the dateext extension, so that the rotated log file has a date in its name that is the same as the timestamps within it.


## delaycompress

delaycompress: compression is delayed until the next rotation.

## rotate

When using the rotate option, logrotate sorts all rotated filenames to find out which logfiles are older and should be removed.


"rails.debug.1" will always be the second newest. Then rails.debug.2.bz2, .... 所以它是每次把所有文件重命名一下？

# if "rotate 10"

-rw-r--r-- 1 root root 52 Aug 30 18:05 /var/log/rails.debug.10.bz2
-rw-r--r-- 1 root root 52 Aug 30 18:05 /var/log/rails.debug.9.bz2
-rw-r--r-- 1 root root 52 Aug 30 18:05 /var/log/rails.debug.8.bz2
-rw-r--r-- 1 root root 52 Aug 30 18:05 /var/log/rails.debug.7.bz2
-rw-r--r-- 1 root root 52 Aug 30 18:05 /var/log/rails.debug.6.bz2
-rw-r--r-- 1 root root 52 Aug 30 18:05 /var/log/rails.debug.5.bz2
-rw-r--r-- 1 root root 52 Aug 30 18:05 /var/log/rails.debug.4.bz2
-rw-r--r-- 1 root root 58 Aug 30 18:05 /var/log/rails.debug.3.bz2
-rw-r--r-- 1 root root 58 Aug 30 18:06 /var/log/rails.debug.2.bz2
-rw-r--r-- 1 root root 19 Aug 30 18:13 /var/log/rails.debug.1
-rw-r--r-- 1 root root  0 Aug 30 18:13 /var/log/rails.debug


## size, minsize, maxsize

size:
Log files are rotated only if they grow bigger then size bytes.
It is mutually exclusive with the time interval options, and it causes log files to be rotated without regard for the last rotation time.

minsize:
Log files are rotated when they grow bigger than size bytes, but not before the additionally specified time interval (daily, weekly, monthly, or yearly).
Both the size and timestamp of a log file are considered.

maxsize:
Log files are rotated when they grow bigger than size bytes even before the additionally specified time interval (daily, weekly, monthly, or yearly).
Both the size and timestamp of a log file are considered.


size 200G / 50M / 100K


See SO, esp "Matt"'s comment is good written.

## maxage

logrotate maxage option for log keeping dates?

"maxage count". Remove rotated logs older than "count" days. The age is only checked if the logfile is to be rotated.

# Best practices

## Hourly logrotation

TODO: it's not hourly logrotation?

/tmp/hr_logs {
daily
rotate 4
}
// With this config, /tmp/hr_logs will rotate on daily basis and system will keep 4 copies of the log file appended with date [format: -YYYYMMDD].


## How to handle with old logs if config is changed?

For example, dateformat is changed from "-%Y%m%d-%s" to "-%Y%m%d". How to handle with old logs?

Rename old logs from e.g. "syslog-20160109" to "syslog-20160109-123456789".


What if rotation frequency is changed, e.g. from daily to 6hourly?

Daily has 1 log saved each day, while 6hourly has 4 logs.
Solution: Add 3 extra small bogus logs with the same naming style.