1

I am looking for advice about logrotate.

I have recently installed log2ram to spare my ssd. Since I was not using all 24Gb RAM I assigned 2Gb to /var/log/. currently +- 300Mb is used.

I would like logrotate to move any file ending with .gz potentially in any sub-direcory to /var/old.log/ and maintain the sub-directory structure.

I have done some research and found a possible solution but now raises questions.

Preserve directory structure when moving files using find

Compress old log files and move to new directory

  1. When logrotate runs this side script to move these files for example i moves /var/log/file.log.2.gz will it then not create a new file.log.2.gz when rotating logs instead of moving file.log.2.gz to file.log.3.gz as file.log.2.gz is no longer there. Then eventually the script overwrites the old logs due to the same name

  2. I do not fully understand the olddir option as I understand this could do what I want. but manual states be cautious with wildcards. any help here

  3. When to time this, /var/log is created during boot with the contents of /var/hdd.log/ it then updates /var/hdd.log when rebooting.

I want logrotate to move the compressed files to a other directory so It will not be loaded on the tmpfs but I don't want to edit each /etc/logrotate.d/* file.

I thought maybe put something before log2ram creates /var/log during boot but I do not know where.

This system runs 24/7 and I try to reboot as minimal as possible. OS: Ubuntu 22.04 LTS

Sometimes manuals are too obvious sometimes there very vague. Maybe someone can explain it in a more complex or easier way for me to understand.

Thank you for your time.

2 Answers 2

2
  1. Yes, using the mv command without any options will overwrite any files with the same name. One option to prevent this is to use the --backup=numbered option, which creates a new file with the format filename~*[number]*~ instead of overwriting the existing file. Another option is to make use of other file naming formats like dateext, which renames rotated logs to filename-YYYYMMDD to avoid overwriting files with the same name.

  2. olddir is the location where rotated logs should be stored. The logrotate man page warns against using wildcards, because if this option is absent, then rotated logs are stored in the same directory. If a wildcard is used to signal logrotate to rotate all files (*), then it would affect rotated logs too.

  3. To define a task to be done at boot and shutdown, I suggest using either cronjobs or custom-written init services. Here is an example that should help fix your issue with logrotate:

/var/log/**/*.log {
    daily
    compress
    dateext
    missingok
    noifempty
    sharedscripts
    postrotate
        cd /var/log && find . -type f -name '*.gz' -exec rsync -aR {} /var/old.log/ \;
    endscript
2
  • Thank you for your answer and thank you very much too supply a example. Will try to implement it and will report how it went. Commented May 15, 2023 at 19:50
  • @VincentStans - how did it go? Commented Sep 3, 2024 at 7:17
0

A - global - preremove script can do it:

##  Archive rotated, compressed (`.gz`) log files to `/var/old.log/` before
##  `logrotate` removes them;
##
##    - Paths relative to `/var/log/` will be preserved in `/var/old.log/`;
##    - Paths outside of `/var/log/` produce an error;
##
##  Other files will be ignored;
##
preremove
    set -e
    case "${1}" in
        /var/log/*.gz)
            path_anchored=`echo "${1}" | sed -e 's!^\(/var/log/\)!\1./!'`
            rsync --archive --relative "${path_anchored}" /var/old.log/
            ;;
        *.gz)
            echo "Cannot archive \"${1}\"; path must start with \"/var/log/\"" >&2
            exit 1
            ;;
    esac
    exit 0
endscript

##  Make sure rotated log files have unique names, otherwise you'll be forever
##  archiving `file.log.7.gz` or whatever maximum count the `rotate` directive
##  has been set to.
##
dateext
dateformat .%Y-%m-%dU%s

You can add this as an entry in /etc/logrotate.d/- named such that it sorts before all other entries when /etc/logrotate.conf does include it.

This way, no other logrotate configs need to be altered, provided that they do not override preremove or set nodateext.

Any high rotate <count> will prevent rotated logs from being archived any time soon though, so those still might need tweaking.

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.