Ubuntu – When & how does logrotate run under Ubuntu 10.04

If the size directive is used, logrotate will ignore the daily, weekly, monthly, and yearly directives. This is not clear in the documentation when you execute the man logrotate command. However it can be confirmed in practice, and is mentioned in some arbitrary blog posts such as this one.

There is a directive called minsize which according to the logrotate man page is the only size directive that can be used in conjunction with the time ones. However, its still not what you want. Using minsize with daily essentially says: rotate the logs daily, but only when they are at least #MB in size.

To date I have found no way with logrotate to do the condition you require: rotate every day, unless the size exceeds #MB, in which case rotate immediately. I do not think this is supported using only logrotate directives. It might be possible to do with some clever scripting via the script hook directives like prerotate, postrotate, firstaction, and lastaction.

Update:

As of logrotate 3.8.1, maxsize and timeperiod are supported together, which would be the ideal solution. See the answer to this post: How to rotate log based on an interval unless log exceeds a certain size?

During a rotation log messages can end up in either the old or the new file, but in a deterministic way. Logrotate does roughly the following for each logfile:

1. Rename the log to the archived name
2. Signal the application to reopen its logs
3. Optionally compress the logfile

If messages get logged between 1 and 2, these will end up in the renamed log, because a rename does not affect open file descriptors (this is also why compression only happens after applications reopen their logs). Messages logged after 2 will end up in the new log.

Here's an excerpt from my logrotate config that does what I described for nginx' logs:

/var/log/nginx/*.log {
    compress
    delaycompress
    postrotate
        [ ! -f /run/nginx.pid ] || kill -USR1 `cat /run/nginx.pid`
    endscript
}