How to set size for system log

Question

My server dumps because of huge system log files. I've heard that we could limit the size of system log by adding such a line size 100m into the file /etc/logrotate.d/rsyslog to do so.

Now my /etc/logrotate.d/rsyslog becomes as below:

/var/log/syslog
{
        rotate 7
        daily
        size 100m
        missingok
        notifempty
        delaycompress
        compress
        postrotate
                invoke-rc.d rsyslog rotate > /dev/null
        endscript
}

My question is: how does size 100m work with rotate 7?

Without size 100m, rotate 7 and daily together mean that the system log will be rotated daily and it will keep 7 days worth of backlogs. Now if I add size 100m and some daily log is bigger than 100m, will it rotate immediately? If so, does it mean that I may get 7 backlogs in a day if some daily log grows too much (more than 700mb)?

Solution

I hope you realize that your using the logrotate mechanism does NOT control the size of the syslog file, it only will each day whenever logrotate is run, take the current /var/log/syslog file and if it is over 100MBytes, compress and save the result. A new /var/log/syslog file is then created which starts receiving messages from that point forward.

Comments

[Zanna]

Your question might be useful as it is, but practically, you should really find the underlying problem as logs shouldn't become huge. See Very large log files, what should I do? for example

[Marcus]

The background of the question is useful; there must be some limit to any logfile, even if it's just physical disk or memory space. Better to manage that than to wait... Regarding a solution: Apart from setting the logrotate limits, there is an answer by setting max-size on Output channelsof rsyslogd pointed out in section "Limit the size of the current syslog" of [askubuntu.com/questions/184949/…. Disclaimer: did not validate that myself.