2 2
eejeel

Fault in logrotate functionality?

Recommended Posts

I'am running the latest Stretch server version on a PiOne (Linux 4.14.65-sunxi).
I think that something is going wrong with the logrotate. The rotation is done in /var/log.hdd directory (see also the scripts in /etc/logrotate.d/).
But the original file of each is in /var/log directory and is not "cleared" after the rename, because it is not renamed.
So, if Zram copies /var/log directory to the /var/log.hdd directory, the original file in /var/log with old logging and included new logging is written to the /var/log.hdd directory. In the next logrotate this growing file is compressed.
In this situation/in my case the compressed files contains all the loggings and not only the loggings of the last day or week or month, depending which file is compressed. And the file is still growing and growing.

 

Is my conclusion right or is something wrong in my Stretch installation. In the latest case, I could not find it. Please give me a hint.

Share this post


Link to post
Share on other sites
2 hours ago, Markus Rohner-Bührer said:

Yes, Same problem here. var/log in ZRAM grows and grows. I see no sense in rotating logs on var/log.hdd

What would be a feasible solution? Change all cron jobs?


It should work this way: https://github.com/armbian/build/blob/master/packages/bsp/common/usr/lib/armbian/armbian-truncate-logs

# write to SD
/usr/lib/armbian/armbian-ramlog write >/dev/null 2>&1

# rotate logs on "disk"
chown root.root -R /var/log.hdd
/usr/sbin/logrotate --force /etc/logrotate.conf

# truncate
/usr/bin/find /var/log -name '*.log' -or -name '*.xz' -or -name 'lastlog' -or -name 'messages' -or -name 'debug' -or -name 'syslog' | xargs truncate --size 0
/usr/bin/find /var/log -name 'btmp' -or -name 'wtmp' -or -name 'faillog' | xargs truncate --size 0

# remove
/usr/bin/find /var/log -name '*.[0-9]' -or -name '*.gz' | xargs rm >/dev/null 2>&1

triggered by cron job:

*/15 * * * * root /usr/lib/armbian/armbian-truncate-logs

Where is the problem?

Share this post


Link to post
Share on other sites
Quote

 

/usr/sbin/logrotate --force /etc/logrotate.conf

logrotate_script: 2: logrotate_script: /usr/lib/rsyslog.hdd/rsyslog-rotate: not found

error: error running non-shared postrotate script for /var/log.hdd/syslog of '/var/log.hdd/syslog

'

logrotate_script: 2: logrotate_script: /usr/lib/rsyslog.hdd/rsyslog-rotate: not found

error: error running shared postrotate script for '/var/log.hdd/mail.info

/var/log.hdd/mail.warn

/var/log.hdd/mail.err

/var/log.hdd/mail.log

/var/log.hdd/daemon.log

/var/log.hdd/kern.log

/var/log.hdd/auth.log

/var/log.hdd/user.log

/var/log.hdd/lpr.log

/var/log.hdd/cron.log

/var/log.hdd/debug

/var/log.hdd/messages

 

 

Share this post


Link to post
Share on other sites

You seems to have some old version. Edit /etc/logrotate.d/rsyslog and fix path from /usr/lib/rsyslog.hdd/rsyslog-rotate to /usr/lib/rsyslog/rsyslog-rotate

Share this post


Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.

Guest
Reply to this topic...

×   Pasted as rich text.   Restore formatting

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

Loading...
2 2