Unix logrotate specify chunk size

log-fileslogrotate

How can I specify output file size which I want after rotation? For example lets say I want to run logrotate when log file reaches 10MB and I want to split this log into chunks which are 1MB max. I have found options "size" but this sets limit above which logrotate is run and not the size of desired chunk. Thanks

Best Answer

logrotate by itself doesn't support the splitting of the rotated log/s, only compression.

You may be able to get the desired behaviour by writing a script of your own that handles the splitting, and call that as a postrotate script in your logrotate configuration for that particular file/s.

update: based on your comment ("it is too late to split files, because they will be splitted by logrotate"), it seems you still have the idea that logrotate is doing splitting of files. This isn't correct, what actually happens is that logrotate renames the existing file and creates a new empty file with the original name.

An example:

/var/log/syslog
{
        rotate 7
        daily
        missingok
        notifempty
        delaycompress
        compress
        postrotate
                reload rsyslog >/dev/null 2>&1 || true
        endscript
}

When logrotate runs:

  • it renames /var/log/syslog to /var/log/syslog.1
  • it then creates a new empty file /var/log/syslog.
  • renaming a file has no effect on any processes that had an open file handle, so after doing this, the rsyslog process is still writing to the old file, syslog.0. Typically, the way to get around this is to reload the process/es that write to the file, which is what happens in the postrotate script. rsyslog is told to reload, it closes its existing file handle to /var/log/syslog.0, and opens a new file handle using the filename /var/log/syslog, the new empty file created by logrotate.

Hopefully you have a better understanding of what logrotate is doing now.

update 2: I'll address your comments here, as formatting options in the comments section are limited.

So when I understand right in the post processing part it is necessary to reload rsyslog to enshure that old file descriptor (before rotation) will be closed and new file descriptor (after rotation) will be opened (because of: mv syslog syslog.1)?

100% correct. After logrotate moves the file, rsyslog is still writing to the old file descriptor. A process performs I/O on the file descriptor, the name is only of interest when performing the initial open on the file.

I thought that logrotate has some mechanism to achieve this automatically.

No, hence the need to do it in a postrotate script. Remember that not all logging is necessarily done by a process which keeps an open file descriptor. If you have a process which opens a file, writes to it and then closes (the file descriptor) repeatedly, then you needn't fuss with anything in the postrotate.

PS: Did you mean "syslog.0" not "syslog" in the following senetence: "the rsyslog process is still writing to the old file, syslog.0."? Becuse "old" log is /var/log/syslog not /var/log/syslog.0. Thank you

No. I mean that it's still writing to the existing file descriptor, which logrotate has renamed to syslog.0. When dealing with processes like rsyslog, always remember that the file name is only relevant at the point when rsyslog opens it, i.e. when it creates the file descriptor. After that you can rename, move, even delete the file, and the process continues performing I/O on the file descriptor unhindered.

Related Topic