5

My server dumps because of huge system log files. I've heard that we could limit the size of system log by adding such a line size 100m into the file /etc/logrotate.d/rsyslog to do so.

Now my /etc/logrotate.d/rsyslog becomes as below:

/var/log/syslog
{
        rotate 7
        daily
        size 100m
        missingok
        notifempty
        delaycompress
        compress
        postrotate
                invoke-rc.d rsyslog rotate > /dev/null
        endscript
}

My question is: how does size 100m work with rotate 7?

Without size 100m, rotate 7 and daily together mean that the system log will be rotated daily and it will keep 7 days worth of backlogs. Now if I add size 100m and some daily log is bigger than 100m, will it rotate immediately? If so, does it mean that I may get 7 backlogs in a day if some daily log grows too much (more than 700mb)?

Yves
  • 1,288
  • 6
  • 19
  • 34
  • 1
    Your question might be useful as it is, but practically, you should really find the underlying problem as logs shouldn't become huge. See Very large log files, what should I do? for example – Zanna Nov 02 '18 at 09:19
  • The background of the question is useful; there must be some limit to any logfile, even if it's just physical disk or memory space. Better to manage that than to wait... Regarding a solution: Apart from setting the logrotate limits, there is an answer by setting max-size on Output channelsof rsyslogd pointed out in section "Limit the size of the current syslog" of [https://askubuntu.com/questions/184949/how-do-i-limit-the-size-of-my-syslog/1083570#1083570]. Disclaimer: did not validate that myself. – Marcus Nov 02 '18 at 11:55

1 Answers1

3

I hope you realize that your using the logrotate mechanism does NOT control the size of the syslog file, it only will each day whenever logrotate is run, take the current /var/log/syslog file and if it is over 100MBytes, compress and save the result. A new /var/log/syslog file is then created which starts receiving messages from that point forward.

mdpc
  • 1,199