Linux – How does one keep a file’s timestamp (date modified) after a logrotate

I believe it's the content of the state file, which is my case is /var/lib/logrotate.status. Each file has one line, which is the date on which it was last rotated; if you run logrotate on such a date that a given file is due for rotation, given the number of days between current date and the date in the file (1 for daily, 7 for weekly, etc.), the file will be rotated.

logrotate doesn't seem to care at what time of day it's run; even if it usually runs at 2355, if you were to run it at 0130 instead, it would still rotate files marked daily and last done yesterday; but having done so it would put today's date into the state file (against any rotated files), so a second run at 2355 would do nothing.

Some questions are answered here: logrotate daily and size?

Typically logrotate will only be run once daily, so the size limits will not be honoured exactly. logrotate's status file (possibly /var/lib/logrotate.status) only stores dates (not times), it is not intended for use more frequently, so you cannot trivially rotate files more frequently (Update: version 3.85 adds hourly support, and stores a complete timestamp in the state file.)

You don't say which syslogd you're using, rsyslog and syslog-ng support self-managed size based rotation, so you should be able to get those to rotate by size, and get logrotate to rotate weekly (though some thought might be required for file naming to make sure simultaneous file rotation doesn't accidentally delete something).

One other option is to use piped logs, just like Apache, in fact Apache-2.4's rotatelogs supports exactly this feature (previous versions only supported size or time independently). You don't say where the logs are originating from, but you might be able to log to a pipe or fifo, and use rotatelogs, if that's supported.

With logrotate <= v3.8.0 the three supported scenarios are:

1. size rotate by size, once daily at most, regardless of elapsed time period
2. rotate unconditionally by time period (i.e. daily, weekly, monthly, yearly), regardless of size
3. minsize & time period if logfile size exceed minsize, then rotate by time period (with `notifempty as a special case of this)

logrotate v3.8.1 adds:

4. maxsize & time period rotate when either size exceeds maxsize, or after elapsed timeperiod. logrotate may need to be run more than the default once per day in this case.

logrotate v3.8.5 adds:

5. hourly time period support, and storing a complete timestamp in the state file. You should run logrotate (at least) hourly for this to work properly.