How can I configure logrotate without having `/etc/logrotate.d/rsyslog`?

Question

I am trying to configure log rotation on my Ubuntu machine so that logs are rotated every day and kept for 14 days. Most tutorials I find, such as this one, mention that I should modify /etc/logrotate.d/rsyslog but that file does not exist on my machine. How can I tell where logrotation settings are stored? What file do I need to modify in Ubuntu 16.04 to configure daily log rotation?

When I look at man logrotate it looks like the configuration is in /etc/logrotate.conf. Here is the content of that file:

# see "man logrotate" for details
# rotate log files weekly
weekly

# use the syslog group by default, since this is the owning group
# of /var/log/syslog.
su root syslog

# keep 4 weeks worth of backlogs
rotate 4

# create new (empty) log files after rotating old ones
create

# uncomment this if you want your log files compressed
#compress

# packages drop log rotation information into this directory
include /etc/logrotate.d

# no packages own wtmp, or btmp -- we'll rotate them here
/var/log/wtmp {
    missingok
    monthly
    create 0664 root utmp
    rotate 1
}

/var/log/btmp {
    missingok
    monthly
    create 0660 root utmp
    rotate 1
}

# system-specific logs may be configured here

That is all that is in there. I tried changing weekly to daily and rotate 4 to rotate 10 but now no logs appear in /var/log/syslog

What am I missing? Do I need to add a setting for /var/log/syslog to this file?

Solution

You don't need the /etc/logrotate.d/rsyslog file to rotate logs. Any file that you create in the /etc/logrotate.d directory can be used to rotate logs. the files are usually created with root ownership and 644 permissions (rx-r--r--).

I do have a /etc/logrotate.d/rsyslog file on my 14.04 server and these are the contents.

/var/log/syslog
{
        rotate 7
        daily
        missingok
        notifempty
        delaycompress
        compress
        postrotate
                reload rsyslog >/dev/null 2>&1 || true
        endscript
}

/var/log/mail.info
/var/log/mail.warn
/var/log/mail.err
/var/log/mail.log
/var/log/daemon.log
/var/log/kern.log
/var/log/auth.log
/var/log/user.log
/var/log/lpr.log
/var/log/cron.log
/var/log/debug
/var/log/messages
{
        rotate 4
        weekly
        missingok
        notifempty
        compress
        delaycompress
        sharedscripts
        postrotate
                reload rsyslog >/dev/null 2>&1 || true
        endscript
}

There may be no logs in your syslog file if it was created after rotation with the wrong permissions and ownership. mine are set to 640 permissions (rw-r-----) and syslog:adm as owner and group.

Comments

[steeldriver]

What version of Ubuntu is this? is it running in a docker container by any chance?