5

My server dumps because of huge system log files. I've heard that we could limit the size of system log by adding such a line size 100m into the file /etc/logrotate.d/rsyslog to do so.

Now my /etc/logrotate.d/rsyslog becomes as below:

/var/log/syslog
{
        rotate 7
        daily
        size 100m
        missingok
        notifempty
        delaycompress
        compress
        postrotate
                invoke-rc.d rsyslog rotate > /dev/null
        endscript
}

My question is: how does size 100m work with rotate 7?

Without size 100m, rotate 7 and daily together mean that the system log will be rotated daily and it will keep 7 days worth of backlogs. Now if I add size 100m and some daily log is bigger than 100m, will it rotate immediately? If so, does it mean that I may get 7 backlogs in a day if some daily log grows too much (more than 700mb)?

Yves
  • 1,358

1 Answers1

3

I hope you realize that your using the logrotate mechanism does NOT control the size of the syslog file, it only will each day whenever logrotate is run, take the current /var/log/syslog file and if it is over 100MBytes, compress and save the result. A new /var/log/syslog file is then created which starts receiving messages from that point forward.

mdpc
  • 1,219