Linux Command – How to Print the Last Line of a gz Compressed File

Adding delaycompress to the configuration section for /var/log/messages solved the problem.

From man logrotate:

   delaycompress
          Postpone  compression of the previous log file to the next rota‐
          tion cycle.  This only has effect when used in combination  with
          compress.   It  can  be used when some program cannot be told to
          close its logfile and thus might continue writing to the  previ‐
          ous log file for some time.

I guess sysklogd, my syslog daemon, cannot be told to close its logfile, and thus this is necessary.

Interestingly, the original configuration I had (without the delaycompress directive), came straight out of man logrotate (except I changed weekly to daily):

   # sample logrotate configuration file
   compress

   /var/log/messages {
       rotate 5
       weekly
       postrotate
           /usr/bin/killall -HUP syslogd
       endscript
   }

Logrotate rotates files, so the answer is yes - probably, and if no sufficient permissions then place them in /backup or something. Check what group and user the rotated logs have :-).

There's options for compression in logrotate, så if "compress" is NOT configured - well then it won't try. Also in your case, "rotate 5" option.

Take a look in /etc/logrotate.d (or where ever it's stored in your system)