I have a syslog server at home and am currently experiencing an issue where my logs will rotate and compress however it will rotate and compress yesterdays file and the newly created log file for the current day. When it does this however it will also create another new file for today and as a result my compressed files look like this:
4.8M Aug 12 23:59 router.2019.08.12.log.1.gz--> this will be the encrypted log file from the 11th of August
5.3K Aug 12 00:02 router.2019.08.12.log.2.gz--> this will be the encrypted log file from the 12th of August Morning
37M Aug 12 00:02 router.2019.08.12.log --> this will be the new current day log file
My question is this, what do I do in order to make sure that only yesterdays file gets compressed at 2 minutes beyond midnight instead of both current and yesterday files. If there is any other information required don't hesistate to ask.
What will happen is logrotate will create a new file for today when we hit midnight as it should.
However when the compression runs it compresses both the newly created .log file for the new day and the .log file from yesterday.
It will still however end up creating a second log file for the new day that starts where the initial one left off so in this case 2 minutes after midnight.
In the morning I end up with two compressed .log files and a none compressed .log file.
Here is a screenshot from windows perpsective. The compressed file at the top would be files from the 11th and the one at the bottom would be the first 2 minutes after midnight for the 12th.
What isn't shown is the third actual log file that would be there (I can't show current because I tried something that didn't work out).
Also apologies for the massive thumbnail.
Most distros have a default crontab entry for logrotate that runs all rule files in /etc/logrotate.d/
(Once a day. Check all the cron files /etc/crontab /etc/cron.d/* /etc/cron.daily/* for the default logrotate!)
With your dedicated crontab entry the rule file /etc/logrotate.d/syslog-ng will run twice.
There is a default logrotate in /etc/daily which looks like this
#!/bin/sh
test -x /usr/sbin/logrotate || exit 0
/usr/sbin/logrotate /etc/logrotate.conf
I looked in the logrotate.conf file and have this and just now uncommented compress and create.
# see "man logrotate" for details
# rotate log files weekly
daily
# keep 4 weeks worth of backlogs
rotate 2
# create new (empty) log files after rotating old ones
create
# uncomment this if you want your log files compressed
compress
# packages drop log rotation information into this directory
include /etc/logrotate.d
I removed my entries in crontab that were forcing the rotation to run using the syslog-ng.conf file.
I shall see what happens tomorrow/tonight and will let you know. Thanks to you both for the help in the mean time!
So I don't know if it's a win or not but on the bright side it didn't compress more than once on the down side it didn't compress at all.
Wondering if I should move the file to a new folder and compress it there instead.
delaycompress will not compress the first backup, but start compressing with the second backup if compress is used.
If globally (in /etc/logrotate.conf) there is delaycompress, then it can be inhibited in an individual rule file with nodelaycompress.
Some daemons do not like compression on their current/open log file(s), then delaycompress or copytruncate is necessary.