Some people mistake the maxsize
option for size
. Well the naming scheme certainly is confusing.
maxsize
does take the rotation interval for consideration. It will rotate the file if the interval is reached or the file is bigger than maxsize
. This is really nice and definitely what you want, if you are working with sensitve data, that should not be stored longer than a finite amount of time. This way you make sure, you save on some precious disk space, while still being able to delete log-files with entries older than X.
/var/log/exim4/mainlog /var/log/exim4/rejectlog { daily missingok maxage 10 compress maxsize 100M }
We will rotate the log files at least daily or when they are bigger than 100M. Now we can run logrotate every hour or even more often, to prevent growing too big too fast. Log files older than 10 days will get deleted. Now we keep log entries for no more than 11 Days.
It is really important to use maxsize together with an interval or else it just asumes every time the script is called, you want to rotate the logfile and maxsize is not going to stop it.
Also be aware if you usemaxsize
and maxage
with rotate
. It might delete files before reaching maxage and you will potentially lose some logs.
size
is only good, if you have a log file that’s growing rapidly in size in irregular intervals, where you want to run logrotate as often as possible to keep the logs small. size
cannot be used together with an interval. You need maxsize
for that. But maxsize
is only available in logrotate versions after 3.8.1.
/var/log/exim4/paniclog { size 10M missingok rotate 10 compress }