Logrotate size issue

System Administration
1

Why logrotate using "size" threshold for some log files even though no "size" parameter used in the configuration file?

I have following logrotate conf file:

/oraadm/diag/rdbms/rfxd2/RFXD2/trace/.trc {
missingok
nomail
postrotate
/usr/bin/find /oraadm/diag/rdbms/rfxd2/RFXD2/trace/ -name "RFXD2trc" -type f -mtime +30 -exec rm {} ;
endscript
}

/oraadm/diag/rdbms/rfxd2/RFXD2/trace/.trm {
missingok
nomail
postrotate
/usr/bin/find /oraadm/diag/rdbms/rfxd2/RFXD2/trace/ -name "RFXD2trm" -type f -mtime +30 -exec rm {} ;
endscript
}

/oraadm/diag/rdbms/rfxd2/RFXD2/trace/alert_RFXD2.log {
notifempty
size 1M
copytruncate
dateext
missingok
rotate 20
compress
}

/apps/oracle/database/RFXD2/product/12.1.0.2/rdbms/audit/.aud {
missingok
nomail
postrotate
/usr/bin/find /apps/oracle/database/RFXD2/product/12.1.0.2/rdbms/audit/ -name "RFXD2aud" -type f -mtime +30 -exec rm {} ;
endscript
}

For some reason the postrotate scipt is not being run becuase of size error, eg;

considering log /apps/oracle/database/RFXD3/product/12.1.0.2/rdbms/audit/delphix_sid_ora_190407_20210909092335332752143795.aud
log does not need rotating (log size is below the 'size' threshold)

But I dont want size to be considered, I just want the postrotate script to be run to delete anything older than 30 days.

If I specify size 0 in the clauses (sections) then all trc, trm and aud files are deleted without the postrotate being run..

Frustrating..

Any idea whats going on?

Thanks for any help

jd

2

@jonnyd

are you sure your find command is returning files that you expect ... -name 'RFXD2aud' would only match that exact name - not 'RFXD2aud.aud' or do you mean 'RFXD2.aud' ?
ditto for other entries

  • what is the size of the file(s) not being rotated ?
  • are the other entries working as expected?
3

Thank you for reply.

Yes I have checked the find command is working as expected.
Actually I have modified the find command as follows:

*/usr/bin/find /apps/oracle/database/RFXD2/product/12.1.0.2/rdbms/audit/ -name "aud " -type f -mtime +30 -exec rm {} ; <-- ALL *.aud files

Is there some default 'size'.

I dont care about size, I need older files deleted..
Why is the find command being ignored because of 'size' warning?

All I want to do is have logrotate delete audit files that are older than 30 days.. Thats it!

4

hmm, I think -name 'aud' will only provide 1 file with the literal name aud nothing else, but happy to be proven wrong, can you

(include the command in your responses)
provide a full directory listing where you are looking at
ls -al

  • ditto , show the output of the find command please

thanks

5

For some reason this forum does not allow * to be posted..

It is searching for all *.aud files.

6

oracle@LDN_ORA_DEV:/apps/oracle/database/RFXD2/product/12.1.0.2/rdbms/audit $ /usr/bin/find /apps/oracle/database/RFXD2/product/12.1.0.2/rdbms/audit/ -name ".aud" -type f -mtime +30 |wc -l
16594

This search is using -name ".aud" Im not sure why this forum is not letting me paste *

7

image
image1343×129 5.53 KB

8

use markdown code tag described here when posting code/data sample.
For the multi-line data/code samples, enclose your sample in tripple backticks (```).
E.g.

```
my code/data goes here 
```

which yields the posting as:

my code/data goes here
9

simple copy/paste works

example from a test directory

ls -l
total 128
-rw-r--r--   1 munke  staff     0 25 Jul 14:31 20.aud
-rw-r--r--   1 munke  staff     0 25 Jul 14:31 21.aud
-rw-r--r--   1 munke  staff     0 25 Jul 14:31 22.aud
-rw-r--r--   1 munke  staff     0 25 Jul 14:31 23.aud
-rw-r--r--   1 munke  staff     0 25 Jul 14:31 24.aud
-rw-r--r--   1 munke  staff     0 25 Jul 14:31 25.aud
-rw-r--r--   1 munke  staff   141 18 Jul 17:22 car.js
-rw-r--r--   1 munke  staff     1 18 Jul 17:09 file.csv
-rw-r--r--   1 munke  staff  1000 18 Jul 15:47 file.html
-rwxr-xr-x   1 munke  staff   254 18 Jul 16:56 jq.bash
-rw-r--r--   1 munke  staff   614 18 Jul 15:58 js1
-rwxr-xr-x   1 munke  staff  1145 18 Jul 16:54 js1.bash
-rw-r--r--   1 munke  staff  1267 18 Jul 17:13 json.out
-rwxr-xr-x   1 munke  staff   211 18 Jul 17:15 puppy.pup
-rw-r--r--   1 munke  staff   747 18 Jul 15:57 script
-rw-r--r--   1 munke  staff  1905 18 Jul 15:46 title
-rw-r--r--   1 munke  staff  1415 18 Jul 20:59 tojson.js
-rw-r--r--   1 munke  staff  1012 18 Jul 17:03 xml.out

find ./ -name 'aud'  # nothing returned
10

The individual find commands run ok.
Thanks for the display tips.

My query is specific to logrotate.

Why are files NOT being cleared down and the following size error being generated:

"log does not need rotating (log size is below the 'size' threshold)".

I just want logrotate to clear down the files older than 30 days..

/apps/oracle/database/RFXD2/product/12.1.0.2/rdbms/audit/*.aud {
missingok
nomail
postrotate
/usr/bin/find /apps/oracle/database/RFXD2/product/12.1.0.2/rdbms/audit/ -name "*aud*" -type f -mtime +30 -exec rm {} ;
endscript
}

/oraadm/diag/rdbms/rfxd2/RFXD2/trace/*.trc {
missingok
nomail
postrotate
/usr/bin/find /oraadm/diag/rdbms/rfxd2/RFXD2/trace/ -name "*trc*" -type f -mtime +30 -exec rm {} ;
endscript
}

/oraadm/diag/rdbms/rfxd2/RFXD2/trace/*.trm {
missingok
nomail
postrotate
/usr/bin/find /oraadm/diag/rdbms/rfxd2/RFXD2/trace/ -name "*trm*" -type f -mtime +30 -exec rm {} ;
endscript
}

/oraadm/diag/rdbms/rfxd2/RFXD2/trace/alert_RFXD2.log {
notifempty
size 1M
copytruncate
dateext
missingok
rotate 20
compress
}

11

output of manually run find command on audit directory.

oracle@LDN_ORA_DEV:/home/oracle/logrotateconf $ /usr/bin/find /apps/oracle/database/RFXD2/product/12.1.0.2/rdbms/audit/ -name "*.aud*" -type f -mtime +30 |more
/apps/oracle/database/RFXD2/product/12.1.0.2/rdbms/audit/delphix_sid_ora_100927_20230606054219440451143795.aud
/apps/oracle/database/RFXD2/product/12.1.0.2/rdbms/audit/delphix_sid_ora_101005_20230331154051435103143795.aud
/apps/oracle/database/RFXD2/product/12.1.0.2/rdbms/audit/delphix_sid_ora_101012_20230606054220525736143795.aud
/apps/oracle/database/RFXD2/product/12.1.0.2/rdbms/audit/delphix_sid_ora_101041_20230604173925743180143795.aud
/apps/oracle/database/RFXD2/product/12.1.0.2/rdbms/audit/delphix_sid_ora_102904_20230603173746458276143795.aud
/apps/oracle/database/RFXD2/product/12.1.0.2/rdbms/audit/delphix_sid_ora_102971_20230603173747645101143795.aud
/apps/oracle/database/RFXD2/product/12.1.0.2/rdbms/audit/delphix_sid_ora_105349_20230323022616514571143795.aud
/apps/oracle/database/RFXD2/product/12.1.0.2/rdbms/audit/delphix_sid_ora_105409_20230323022617591983143795.aud
/apps/oracle/database/RFXD2/product/12.1.0.2/rdbms/audit/delphix_sid_ora_106205_20230604053840066794143795.aud
/apps/oracle/database/RFXD2/product/12.1.0.2/rdbms/audit/delphix_sid_ora_106288_20230604053841303229143795.aud
/apps/oracle/database/RFXD2/product/12.1.0.2/rdbms/audit/delphix_sid_ora_106392_20230603053658681899143795.aud
/apps/oracle/database/RFXD2/product/12.1.0.2/rdbms/audit/delphix_sid_ora_106503_20230603053659843267143795.aud
/apps/oracle/database/RFXD2/product/12.1.0.2/rdbms/audit/delphix_sid_ora_107579_20230605174115959240143795.aud
/apps/oracle/database/RFXD2/product/12.1.0.2/rdbms/audit/delphix_sid_ora_107644_20230415160716852504143795.aud
/apps/oracle/database/RFXD2/product/12.1.0.2/rdbms/audit/delphix_sid_ora_107677_20230605174117061284143795.aud
/apps/oracle/database/RFXD2/product/12.1.0.2/rdbms/audit/delphix_sid_ora_107931_20230427164525256455143795.aud
/apps/oracle/database/RFXD2/product/12.1.0.2/rdbms/audit/delphix_sid_ora_107943_20230427164526282552143795.aud
/apps/oracle/database/RFXD2/product/12.1.0.2/rdbms/audit/delphix_sid_ora_107968_20230304015211264141143795.aud
/apps/oracle/database/RFXD2/product/12.1.0.2/rdbms/audit/delphix_sid_ora_108049_20230304015212339494143795.aud
/apps/oracle/database/RFXD2/product/12.1.0.2/rdbms/audit/delphix_sid_ora_10809_20230310140357780734143795.aud
/apps/oracle/database/RFXD2/product/12.1.0.2/rdbms/audit/delphix_sid_ora_10933_20230324142850179247143795.aud
/apps/oracle/database/RFXD2/product/12.1.0.2/rdbms/audit/delphix_sid_ora_10942_20230310140358860233143795.aud
/apps/oracle/database/RFXD2/product/12.1.0.2/rdbms/audit/delphix_sid_ora_110272_20230206130122324453143795.aud
/apps/oracle/database/RFXD2/product/12.1.0.2/rdbms/audit/delphix_sid_ora_110348_20230206130123399590143795.aud
/apps/oracle/database/RFXD2/product/12.1.0.2/rdbms/audit/delphix_sid_ora_110442_20230207130327127687143795.aud
/apps/oracle/database/RFXD2/product/12.1.0.2/rdbms/audit/delphix_sid_ora_110465_20230510173811881590143795.aud
/apps/oracle/database/RFXD2/product/12.1.0.2/rdbms/audit/delphix_sid_ora_110479_20230510173812963384143795.aud
/apps/oracle/database/RFXD2/product/12.1.0.2/rdbms/audit/delphix_sid_ora_127203_20230312020627439632143795.aud
/apps/oracle/database/RFXD2/product/12.1.0.2/rdbms/audit/delphix_sid_ora_127765_20230225134001996503143795.aud
/apps/oracle/database/RFXD2/product/12.1.0.2/rdbms/audit/delphix_sid_ora_127874_20230210010807058048143795.aud
/apps/oracle/database/RFXD2/product/12.1.0.2/rdbms/audit/delphix_sid_ora_127905_20230225134003079272143795.aud
/apps/oracle/database/RFXD2/product/12.1.0.2/rdbms/audit/delphix_sid_ora_128184_20230326033120654916143795.aud
/apps/oracle/database/RFXD2/product/12.1.0.2/rdbms/audit/delphix_sid_ora_128238_20230326033121733679143795.aud
/apps/oracle/database/RFXD2/product/12.1.0.2/rdbms/audit/delphix_sid_ora_129610_20230509164942470611143795.aud
/apps/oracle/database/RFXD2/product/12.1.0.2/rdbms/audit/delphix_sid_ora_129724_20230509164943674827143795.aud
/apps/oracle/database/RFXD2/product/12.1.0.2/rdbms/audit/delphix_sid_ora_130209_20230317141636027442143795.aud
/apps/oracle/database/RFXD2/product/12.1.0.2/rdbms/audit/delphix_sid_ora_130226_20230427170630051553143795.aud
/apps/oracle/database/RFXD2/product/12.1.0.2/rdbms/audit/delphix_sid_ora_144811_20230513045628937184143795.aud
/apps/oracle/database/RFXD2/product/12.1.0.2/rdbms/audit/delphix_sid_ora_146664_20230609054750555834143795.aud
/apps/oracle/database/RFXD2/product/12.1.0.2/rdbms/audit/F2BD2_ora_101039_20230506023824218291143795.aud
/apps/oracle/database/RFXD2/product/12.1.0.2/rdbms/audit/F2BD2_ora_101057_20230430223354024554143795.aud
--More--
12

thats not what you originally posted.

use copy/paste they are difficult to read, no way copy, manipulate for the team to use/test.

also, don't post 1 thing then execute another
your original posts had no wildcards in the find command 'aud' now '*.aud' :frowning:

13

I keep saying..
I was only able to paste the full command after you advised me to use ````````` otherwise * was not showing..

15

I need to "master" the markdown code tag usage a bit more - I've edited your previous post for now to ease the understanding.
A couple of comments:

  1. your '*aud*' should be '*.aud' - to make if more restrictive
  2. your -exec rm {} ; should be -exec rm {} \; (or -exec rm {} +)

I'll let you browse the man find to get a better understanding of the suggested changes.

17

Instead of smart remarks some help on logrotate would useful.

This is the logrotate config file.

It is syntactially correct.

/apps/oracle/database/RFXD2/product/12.1.0.2/rdbms/audit/*.aud {
missingok
nomail
postrotate
/usr/bin/find /apps/oracle/database/RFXD2/product/12.1.0.2/rdbms/audit/ -name "*aud*" -type f -mtime +30 -exec rm {} \;
endscript
}

/oraadm/diag/rdbms/rfxd2/RFXD2/trace/*.trc {
missingok
nomail
postrotate
/usr/bin/find /oraadm/diag/rdbms/rfxd2/RFXD2/trace/ -name "*trc*" -type f -mtime +30 -exec rm {} \;
endscript
}

/oraadm/diag/rdbms/rfxd2/RFXD2/trace/*.trm {
missingok
nomail
postrotate
/usr/bin/find /oraadm/diag/rdbms/rfxd2/RFXD2/trace/ -name "*trm*" -type f -mtime +30 -exec rm {} \;
endscript
}

/oraadm/diag/rdbms/rfxd2/RFXD2/trace/alert_RFXD2.log {
notifempty
size 1M
copytruncate
dateext
missingok
rotate 20
compress
}

20

I think you're misinterpreting the markdown code tag usage. I'd sugest rereading the posted link for the markdown code tag usage AND the sample usage I've posted previously.
See it help a bit more.

21

Please can you stop being pedantic.
The code is there its correct you can read it.

Any suggestions on logrotate would be helpful if not then please stop posting!

24

@jonnyd, I see in your original post here you had -exec rm {} ; instead of suggested -exec rm {} \;.
Hence there was my suggestion to modify the find command.
Looks like you're followed the suggested NOW.
Still doesn't work?
Why are you opening another thread on the same subject? Can it not be resolved here, in the original thread? Double posting is prohibited by the rules of this forum. Please don't do it again.
I'll close the new thread. Please continue here.

As for "being pedantic", I'd say you'll get a better traction (if any) if properly format your posts and follow the rules.

I'd also suggest "stop biting hand feeding you" - you'll get much further without doing it again.

25

Please could someone suggest why the postrotate script is not running?

26

Ive slimmed down the logrotate config file as follows:

audit_rfxd2.conf
/apps/oracle/database/RFXD2/product/12.1.0.2/rdbms/audit/*.aud {
missingok
nomail
postrotate
/usr/bin/find /apps/oracle/database/RFXD2/product/12.1.0.2/rdbms/audit/ -name "*aud*" -type f -mtime +30 -exec rm {} \;
endscript
}

When I run logrotate as follows:

oracle@LDN_ORA_DEV:/home/oracle/logrotateconf $ logrotate -v /home/oracle/logrotateconf/audit_rfxd2.conf -s /home/oracle/logrotateconf/TMP_FILES/audit_rfxd2.tmp >/home/oracle/logrotateconf/LOG_FILES/audit_rfxd2.log

I get the following output (shortened::

...
...
considering log /apps/oracle/database/RFXD2/product/12.1.0.2/rdbms/audit/RFXD2_ora_125504_20230510175525987809143795.aud
log does not need rotating (log size is below the 'size' threshold)
set default create context

Why is the postrotate script not running?