logrotate.txt

- logrotate is triggered by cron, usually from /etc/cron.daily/logrotate:

  #!/bin/sh
  /usr/sbin/logrotate /etc/logrotate.conf # main config
  ...
  include /etc/logrotate.d # extra configs

- debugging:

  logrotate -df /etc/logrotate.d/...
             |+-- force
             +-- debug (dry run with implied -v)

  NB: options specified in /etc/logrotate.conf won't be read! We would need to
      run our test with logrotate -df /etc/logrotate.conf for that. Any missing
      options in /etc/logrotate.d/... must be copied over for the test.

  notes:
  * make sure crond is running and there aren't duplicate instances
  * check:
    /var/log/cron
    /var/lib/logrotate.status

- syntax:

  /var/log/httpd/access.log
  /var/log/httpd/error.log
  {
    rotate 5
    ...
  }

- copytruncate vs create:

  copytruncate should be used with services like apache that keep files open
  continuously. Such services won't notice the file has been renamed (ex:
  error.log -> error.log.1.gz) and will keep writing to the old file descriptor
  now pointing to error.log.1.gz. copytruncate won't change the file
  descriptor, it will simply copy the contents of the current file to a new
  file (error.log.1.gz) then truncate to 0 the current one and continue to
  write there. If in your prerotate script you stop the service there is no
  point using copytruncate since when the service starts it will open new file
  descriptors (the newly created error.log).

- rotating on size:

  minsize: size and time (ex: 10M + daily)
    * DANGER: even if size is reached before time, no rotation.

  maxsize: size or time
    * sub optimal: even if size isn't reached at time, rotation.

  size: size
    * DANGER: time is ignored but make sure logrotate runs often enough or size could
      grow above it's threshold.

  possible solution for 'minsize' and 'size'
  ------------------------------------------
  add a script in /etc/cron.hourly:
  /usr/sbin/logrotate -s /var/lib/logrotate.status /opt/graphite/conf/logrotate-carbon.conf

  When using dateext, if size grows above threshold, rotation will be skipped
  till the next day with an error message reading that file /var/log/----.Y-m-d
  already exists. dateformat must be used in that case:

  dateext
  dateformat .%Y-%m-%d_%H-%s

- logrotate wrongly sets up $HOME to / so you are screwed if you use
  $HOME in your init scripts