Search code examples
loggingamazon-ec2logrotate

messages log is not rotated via logrotate config

I followed some instructions I found online to apply log rotation via rotated of an aws ec2 instance, the simplest way I found on applying it on /var/log/messages is via this format:

[root@ip-192-168-1-69 ~]# cat /etc/logrotate.d/messages 
/var/log/messages {
    daily
    create 0600 root root
    rotate 3
    size=1M
    compress
    delaycompress
    notifempty
}

I have no idea yet on when the logrotate will happen so I just checked it on the next day and saw this result

[root@ip-192-168-1-69 ~]# ls -ltrh /var/log/messages*
-rw------- 1 root root   0 May 24 13:25 /var/log/messages
-rw------- 1 root root 16M May 25 06:09 /var/log/messages-20210510

It did rotate, however I noticed the new logs goes now to /var/log/messages-20210510 instead on /var/log/messages, and also checking on the 2nd and 3rd day there was no tgz log rotation happened. /var/log/messages-20210510 still keeps updating with the new logs.

I saw this config from /etc/logrotate.d and I'm not sure if this conflicts my created config

[root@ip-192-168-1-69 ~]# cat /etc/logrotate.d/syslog 
/var/log/cron
/var/log/maillog
/var/log/messages
/var/log/secure
/var/log/spooler
{
    sharedscripts
    postrotate
        /bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null || true
    endscript
}

Please share and advise on which I missed here, thanks in advance

Solution

  • Looks like some unwanted directives are getting added from global configurations. I would suggest you to manually rotate the logs using the configs you mentioned (using below command). It will clearly tell you whether your configs are working as expected or not to further debug the issue.

    $ sudo logrotate /etc/logrotate.d/messages

    If this command also doesn't give you expected output, then try adding below configs inside /etc/logrotate.d/rsyslog file at the bottom.

    /var/log/messages {
    daily
    create 0600 root root
    rotate 3
    size 1M
    compress
    delaycompress
    notifempty
}

    Now again try rotating the logs manually using logrotate command. I feel it should work.

    Note: Don't forget to remove existing line /var/log/messages from the common configurations in rsyslog file