I am having some trouble trying to configure log rotation for some syslog-ng local log files I'm trying to keep.
for some reason, the size is not respected and logs are filling my filesystem quickly.
I want to keep something like 3 files of 100Mbs or 3 files of 500Mbs for log files.
my current log rotation configuration is the following :
[root@xm1p1034vmo logs]# cat /etc/logrotate.d/syslog-ng # /app/syslog-ng/logs/syslog-ng.log { missingok notifempty rotate 3 compress maxsize 50M daily create 0600 root root postrotate /bin/kill -HUP `cat /app/syslog-ng/var/syslog-ng.pid 2> /dev/null` 2> /dev/null || true endscript } # /app/syslog-ng/logs/outgoing*log { missingok notifempty rotate 3 compress daily maxsize 100M create 0600 root root postrotate /bin/kill -HUP `cat /app/syslog-ng/var/syslog-ng.pid 2> /dev/null` 2> /dev/null || true endscript } # /app/syslog-ng/logs/incoming*log { missingok notifempty rotate 3 compress daily maxsize 500M create 0600 root root postrotate /bin/kill -HUP `cat /app/syslog-ng/var/syslog-ng.pid 2> /dev/null` 2> /dev/null || true endscript } the crontab is every 3 hours (could put it more often if required) :
# Logrotate 00 03,06,09,12,15,18,21,23 * * * /usr/sbin/logrotate /etc/logrotate.conf >/dev/null 2>&1 but as you can see, the log files are much bigger and grow quickly :
[root@xm1p1034vmo logs]# ls -al total 8065908 drwxr-xr-x 2 root root 4096 May 2 09:07 . drwxr-xr-x 11 root root 4096 Dec 20 16:08 .. -rw------- 1 root root 5330231 May 2 17:12 cid.log -rw------- 1 root root 4284556769 May 2 17:12 incoming_all.log -rw------- 1 root root 18081021 May 2 09:07 incoming_all.log-20170502.gz -rw------- 1 root root 22753799 May 2 17:12 outgoing_esx.log -rw------- 1 root root 93372 May 2 09:07 outgoing_esx.log-20170502.gz -rw------- 1 root root 1718167 May 2 17:12 outgoing_fireeye.log -rw------- 1 root root 8633 May 2 09:07 outgoing_fireeye.log-20170502.gz -rw------- 1 root root 362817 May 2 17:09 outgoing_iseries.log -rw------- 1 root root 2706 May 2 09:07 outgoing_iseries.log-20170502.gz -rw------- 1 root root 15838 May 2 17:10 outgoing_mssql.log -rw------- 1 root root 345 May 2 09:07 outgoing_mssql.log-20170502.gz -rw------- 1 root root 57358 May 2 17:11 outgoing_nas.log -rw------- 1 root root 722 May 2 09:07 outgoing_nas.log-20170502.gz -rw------- 1 root root 13932 May 2 16:42 outgoing_network.log -rw------- 1 root root 197 May 2 09:07 outgoing_network.log-20170502.gz -rw------- 1 root root 11991510 May 2 17:12 outgoing_oracle.log -rw------- 1 root root 46817 May 2 09:07 outgoing_oracle.log-20170502.gz -rw------- 1 root root 664 May 2 12:15 outgoing_printers.log -rw------- 1 root root 174 May 2 09:07 outgoing_printers.log-20170502.gz -rw------- 1 root root 407191 May 2 17:12 outgoing_san.log -rw------- 1 root root 1968 May 2 09:07 outgoing_san.log-20170502.gz -rw------- 1 root root 3896682829 May 2 17:12 outgoing_unix.log -rw------- 1 root root 16055682 May 2 09:07 outgoing_unix.log-20170502.gz -rw------- 1 root root 1179031 May 2 17:12 outgoing_win.log -rw------- 1 root root 2845 May 2 09:07 outgoing_win.log-20170502.gz -rw------- 1 root root 4003 May 2 16:47 syslog-ng.log -rw------- 1 root root 386 May 2 09:07 syslog-ng.log-20170502.gz [root@xm1p1034vmo logs]# what did I do wrong in the logrotate/crontab config please ? I want to keep 3 logs of 100Mb for every outgoing* log file, and 3 logs of 500Mb for every outgoing* log file
thanks regards,
