Logrotate does not auto rotate when based on log size

Question

I have a custom application (myApp) which is writing logs to the file '/var/log/myApp'. I can see the logs being written and it works fine. Now I am trying to setup logrotate for this file and for this I have created a config file '/etc/logrotate.d/myApp', the contents of which are -

/var/log/myApp {
   missingok
   size +10k
   start 0
   nocompress
   create 0600 root root
   rotate 10
   postrotate
     /etc/init.d/rsyslog restart > /dev/null 2>&1 || true
   endscript
}

Now if i do a logrotate -dv /etc/logrotate.d/myApp I don't see any errors as such and when logrotate -f /etc/logrotate.d/myApp is executed i.e., a forceful logrotate the log is rotated. But when the log file size exceeds 10k the log is not automatically rotated. Any help would be appreciated.

Solution 1

logrotate rotates the logs specified in /etc/logrotate.d/ according to the time interval configured in /etc/logrotate.conf. On some distros, the default value is a week. You can override that time interval in your specific config using e.g. 'daily' in your config file.

Log files will not be rotated until logrotate has known about the files for at least as long as the time specified. I assume that you waited this long and/or modified the conf file?

Solution 2

logrotate is working only once a day , So it's not checking your file size all the time.

if you want an effective way to keep the size lower , you should use a cron job like

for example , force the rotate every hour in your crontab

0 * * * * logrotate <my conf here> 

and your logs will be , if needed, rotated every hour. I had such problem in my free-tier aws server , as the size exceed rapidly and i didn't have enough disk space to wait 24 hours for a rotate

Comments

[Logan]

> Log files will not be rotated until logrotate has known about the files for at least as long as the time specified. Gwha? That's news to me. I didn't see anything in the logrotate man page about that. How would one debug a logrotate conf file without having to wait 24 hours to see if it worked?

[Hogan]

@Logan - You use the -f (force) option.

[pevik]

See also unix.stackexchange.com/questions/15546/… (/var/lib/logrotate/status and -f flag)