Where should I look for logrotate config file of /var/log/mail.log

Question

I would like to change the suffix of mail.log rotated files to include the date, such as

/var/log/mail.log.20180920

I read from this question that /etc/cron.weekly/sysklogd should be changed, but I don't have such a file. I would like to rewrite the defaults, however, it is mentioned in this post to write a new config for that. So I found that because this log file is created by syslog, it's listed in the /etc/logrotate.d/rsyslog, so I changed this file to the following to include the date suffix:

/var/log/syslog
{
        rotate 400
        daily
        missingok
        notifempty
        delaycompress
        compress
        postrotate
                reload rsyslog >/dev/null 2>&1 || true
        endscript
}

/var/log/mail.info
/var/log/mail.warn
/var/log/mail.err
/var/log/mail.log
/var/log/daemon.log
/var/log/kern.log
/var/log/auth.log
/var/log/user.log
/var/log/lpr.log
/var/log/cron.log
/var/log/debug
/var/log/messages
{
        rotate 400
        hourly
        dateext
        dateformat .%Y%m%d
        missingok
        notifempty
        compress
        delaycompress
        sharedscripts
        postrotate
                reload rsyslog >/dev/null 2>&1 || true
        endscript
}

I also delete the entries for rsyslog and mail.log from /var/lib/logrotate/status to force the log to rotate for today, then I run : logrotate /etc/logrotate.conf --debug, but in the output I get:

rotating pattern: 
/var/log/mail.log
 hourly (400 rotations)
empty log files are not rotated, old logs are removed
switching euid to 0 and egid to 104
considering log /var/log/mail.log
  log does not need rotating

so, I do logrotate -f /etc/logrotate.conf to force it to rotate the log, the entries in the /var/lib/logrotate/status gets updated. The file /var/log/maill.log is generated, but what I expect is to see a mail.log.20181020 file, why it does not generate that?

Thank you

Solution 1

From man logrotate:, near the end

FILES

   /var/lib/logrotate/status  Default state file.
   /etc/logrotate.conf        Configuration options.

Solution 2

In the /etc/logrotate.conf you can set following directives:

   dateext
          Archive old versions of log files adding a date extension like YYYYMMDD instead of simply adding a  number.
          The extension may be configured using the dateformat and dateyesterday options.

   dateformat format_string
          Specify  the  extension for dateext using the notation similar to strftime(3) function. Only %Y %m %d %H %M
          %S %V and %s specifiers are allowed.  The default value is -%Y%m%d except hourly, which uses  -%Y%m%d%H  as
          default value.  Note that also the character separating log name from the extension is part of the datefor‐
          mat string. The system clock must be set past Sep 9th 2001 for %s to work correctly.  Note that  the  date‐
          stamps  generated  by this format must be lexically sortable (i.e., first the year, then the month then the
          day. e.g., 2001/12/01 is ok, but 01/12/2001 is not, since 01/11/2002 would sort lower while it  is  later).
          This  is because when using the rotate option, logrotate sorts all rotated filenames to find out which log‐
          files are older and should be removed.

   dateyesterday
          Use yesterday's instead of today's date to create the dateext extension, so that the rotated log file has a
          date in its name that is the same as the timestamps within it.

Further information can be found here or with man logrotate.

Comments

[abu_bua]

You have to edit the /etc/logrotate.conf file. To debug you should run sudo logrotate -f /etc/logrotate.conf.

[Alex]

I know the above commands, my question is why it does not generate the file I expected(with the date extension)

[abu_bua]

you didn't used sudo before the command.

[abu_bua]

Did you proofed that the log is really a new one? You have set notifempty! notifempty - Do not rotate the log if it is empty (this overrides the ifempty option).

[Alex]

I used sudo and the size of the file is not zero.

[abu_bua]

add the output of grep mail /var/lib/logrotate/status to your post.

[Alex]

I've updated the question, can you please take a look?

[Alex]

I've updated the question, can you please take a look?