Link to home
Avatar of enyrix
enyrixFlag for Canada

asked on

rsync logrotate files always backuped

On my server I have some big log files. When I do incremental backup with rsync,
this old log files are always backuped as new because logrotate rename this extentions files to (name.incrementnumber.gz)
eg. syslog, syslog.1 syslog.2.gz syslog.3.gz...
I want to backup these files, without to have to have to resync on each rysync execution.
Can we change extensions files produced by log rotate to use timestamp or using another solution ? Thanks.
ASKER CERTIFIED SOLUTION
Avatar of woolmilkporc
woolmilkporc
Flag of Germany image

Blurred text
THIS SOLUTION IS ONLY AVAILABLE TO MEMBERS.
View this solution by signing up for a free trial.
Members can start a 7-Day free trial and enjoy unlimited access to the platform.
See Pricing Options
Start Free Trial
Avatar of enyrix

ASKER

How to test it ?
root@ubuntu:~# logrotate -vf /var/log/syslog
Ignoring /var/log/syslog because the file owner is wrong (should be root).

Handling 0 logs
root@ubuntu:~# 

Open in new window


Permissions are:
-rw-r-----  1 syslog    adm       672 aoû 22 13:17 syslog
-rw-r-----  1 syslog    adm    595500 aoû 22 06:54 syslog.1
-rw-r-----  1 syslog    adm     34682 aoû 15 06:29 syslog.2.gz
-rw-r-----  1 syslog    adm     15393 jun 26 06:46 syslog.3.gz
-rw-r-----  1 syslog    adm     29474 jun 15 06:50 syslog.4.gz

Open in new window

Try (still as root)

su - syslog -c 'logrotate -vf /var/log/syslog'
Avatar of enyrix

ASKER

Not working
root@ubuntu:~# su - syslog -c 'logrotate -vf /var/log/syslog'
No directory, logging in with HOME=/

Open in new window

Just 'su - syslog' give me same error.
Yes, but the logrotate command should run nonetheless!

I wonder anyway why those syslog files should be owned by "syslog"?
Does syslogd run under syslog's credentials, or do you apply some special handling to the syslog files?
From whose crontab does the regular logrotate process (if any) get started?
Avatar of enyrix

ASKER

I just use a clean installation of ubuntu 14.04.2 LTS for my test. I edited nothing about it, only added dateext in this file /etc/logrotate.d/rsyslog. I'm not too familiar with logrotate, I do not touch anything else. I will try it with another log but I will want to apply this rule for all my logs.
Avatar of enyrix

ASKER

I make a mistake to test it, it is config file not log file in argument.
I also tested this:
logrotate -vf /etc/logrotate.conf 

Open in new window

That's worked for this:
-rw-r--r--  1 root      root        0 aoû 22 14:13 dpkg.log
-rw-r--r--  1 root      root   464157 aoû 15 06:29 dpkg.log.1
-rw-r--r--  1 root      root     5582 aoû 22 06:54 dpkg.log-20150822

Open in new window

but not for syslog yet.
Avatar of enyrix

ASKER

Ok that's worked now, to test it I must use this command:
logrotate -vf /etc/logrotate.conf

Open in new window

in /etc/logrotate.d/rsyslog, I miss to edit  /var/log/syslog also after editing  /var/log/messages
Thanks, my problem should be solved now!
Beginning with 14.04 Ubuntu's /var/log/syslog files are indeed owned by "syslog".

The logrotate configuration files (or /etc/logrotate.conf for the default) should contain "su" options to set the right credentials.
Is such an option present in "/etc/logrotate.d/rsyslog" (the file where you should have added "dateext")?
Avatar of enyrix

ASKER

This is my file:
root@ubuntu:/etc/logrotate.d# cat /etc/logrotate.d/rsyslog
/var/log/syslog
{
	rotate 7
	daily
	dateext
	missingok
	notifempty
	delaycompress
	compress
	postrotate
		reload rsyslog >/dev/null 2>&1 || true
	endscript
}

/var/log/mail.info
/var/log/mail.warn
/var/log/mail.err
/var/log/mail.log
/var/log/daemon.log
/var/log/kern.log
/var/log/auth.log
/var/log/user.log
/var/log/lpr.log
/var/log/cron.log
/var/log/debug
/var/log/messages
{
	rotate 4
	weekly
	dateext
	missingok
	notifempty
	compress
	delaycompress
	sharedscripts
	postrotate
		reload rsyslog >/dev/null 2>&1 || true
	endscript
}

Open in new window

OK, looks good!

I just read your last comments and I should have noticed that you used the wrong parameter for "logrotate", so it's been my mistake as well!

Merci pour quand même m'accorder les points!
Avatar of enyrix

ASKER

Ok I see it in this file /etc/logrotate.conf:
su root syslog

# see "man logrotate" for details
# rotate log files weekly
weekly

# use the syslog group by default, since this is the owning group
# of /var/log/syslog.
su root syslog

# keep 4 weeks worth of backlogs
rotate 4

# create new (empty) log files after rotating old ones
create

# uncomment this if you want your log files compressed
#compress

# packages drop log rotation information into this directory
include /etc/logrotate.d

# no packages own wtmp, or btmp -- we'll rotate them here
/var/log/wtmp {
    missingok
    monthly
    create 0664 root utmp
    rotate 1
}

/var/log/btmp {
    missingok
    monthly
    create 0660 root utmp
    rotate 1
}

# system-specific logs may be configured here

Open in new window

Avatar of enyrix

ASKER

OK, looks good!

I just read your last comments and I should have noticed that you used the wrong parameter for "logrotate", so it's been my mistake as well!

There are times like this! We make errors after errors!

Merci pour quand même m'accorder les points!
Au plaisir ! Tu as deviné que je parle français !? I just edit my profile to add my languages...

Thanks woolmilkporc for your help yet!
C'était pas si dur à deviner, avec ce joli "aoû" dévoilé par "ls" ...

>> Thanks woolmilkporc for your help yet! <<

You're always welcome!