Solved Log file rotation by size and time

[jordanch]

Logfile rotation, which is handled by newsyslog, can be done based on 1) max size of file, 2) at certain time.

My questions is: how does it work when both the conditions are specified? I'd expect it'll rotate when any one condition is met. Is that correct?

But for example, in my newsyslog.conf I have (by default) for auth.log:

/var/log/auth.log                       600  7     100  @0101T JC

So there can be max 7 files, with a size of 100KB max, and it is rotated on every 1st of Jan.

Now when I look at the logs, I see they get rotated according to neither of the criteria (max size 100KB and 1st Jan). I am sure it is a simple thing, but I just don't know. Can someone please help me understand what's going on?

> ls -hlo /var/log/auth.log*
-rw-------  1 root  wheel  uarch   88K May 11 03:00 /var/log/auth.log
-rw-------  1 root  wheel  uarch   12K Apr 25 03:00 /var/log/auth.log.0.bz2
-rw-------  1 root  wheel  uarch   12K Apr 11 16:00 /var/log/auth.log.1.bz2
-rw-------  1 root  wheel  uarch   11K Mar 30 07:00 /var/log/auth.log.2.bz2
-rw-------  1 root  wheel  uarch  9.9K Mar 21 20:00 /var/log/auth.log.3.bz2
-rw-------  1 root  wheel  uarch  9.5K Mar 17 22:00 /var/log/auth.log.4.bz2
-rw-------  1 root  wheel  uarch   11K Mar 15 06:00 /var/log/auth.log.5.bz2
-rw-------  1 root  wheel  uarch   12K Mar  1 02:00 /var/log/auth.log.6.bz2

 

[SirDice]

how does it work when both the conditions are specified? I'd expect it'll rotate when any one condition is met. Is that correct?

Yes.

Now when I look at the logs, I see they get rotated according to neither of the criteria (max size 100KB and 1st Jan).

100KB uncompressed. As it's just plain text it compresses rather well.

 

[jordanch]

Now that I know the answer, the formats and similar sizes of the old files should/could have been clues. Also, the J option indicates rotated logs should be zipped.

 

[SirDice]

Also, the J option indicates rotated logs should be zipped.

bzip2(1) actually, Z uses gzip(1), X uses xz(1) and Y uses zstd(1).

If you're on ZFS (default installation) then /var/log is compressed at the filesystem level, so you can remove the compression from newsyslog.conf if you want.

root@maelcum:~ # zfs get compression zroot/var/log
NAME           PROPERTY     VALUE     SOURCE
zroot/var/log  compression  lz4       inherited from zroot