Linux – How logrotate behave when there is * and there is one explicit filename in log rotation in one path

linuxlogrotateuwsgi

The question is little bit long! Let me explain with the example below. I

have a log-rotation configuration file in /etc/logrotate.d/ which is used for uwsgi:

"/var/log/uwsgi/*.log" "/var/log/uwsgi/*/*.log" {
  copytruncate
  daily
  rotate 5
  compress
  delaycompress
  missingok
  notifempty
}

Let's say I have about 12 uwsgi modules and I want to keep one the uwsgi app log files more than others so I have a configuration like below:

/var/log/uwsgi/app/MY_APP.log {
        daily
        missingok
        rotate 60
        compress
        delaycompress
        notifempty
        create 0640 www-data adm
}

Now the question is how should I create log rotate as above and keep * for 11 other modules. I don't want to create 11 log rotate with the same configuration, What should I do to overwrite just one module?

Best Answer

First, logrotate doesn't have an easy way to override an existing glob match of a file. Simply trying to add a more specific match later in the config will give you an error message.

So in order to work around this, there are basically two ways.

The first one is the easiest: Put the logs that need a different handling in a different directory. That way, you could even make it easy to change the configuration simply by making an app log to a different directory. Example:

"/var/log/uwsgi/*.log" "/var/log/uwsgi/keep05/*.log" {
  copytruncate
  daily
  rotate 5
  compress
  delaycompress
  missingok
  notifempty
}

"/var/log/uwsgi/keep60/*.log" {
  daily
  missingok
  rotate 60
  compress
  delaycompress
  notifempty
  create 0640 www-data adm
}

A second way would be to create an exclusion in the first glob, the one that matches all 12 logs. But since logrotate doesn't have an easy way to exclude a particular file, you're left with what the regular filename matching library provides - and that's essentially just the one character in the filename. If you make the rule that logs that need to be kept for 60 days must start with a 6, and no other logs may start with a 6, you can do this:

"/var/log/uwsgi/*.log" "/var/log/uwsgi/*/[!6]*.log" {
  copytruncate
  daily
  rotate 5
  compress
  delaycompress
  missingok
  notifempty
}

"/var/log/uwsgi/app/6*.log" {
  daily
  missingok
  rotate 60
  compress
  delaycompress
  notifempty
  create 0640 www-data adm
}

I recommend the first version; it'll probably be easiest to keep track of if/when you add more apps.

Related Topic