Hi I am using Centos 5.1 and I have a weird problem with squid logs rotation. I have the file squid as follow in /etc/logrotate.d:
Recently I reduce size parameter.
/var/log/squid/access.log { weekly missingok rotate 10 compress create 0660 squid squid missingok size 200M postrotate /usr/sbin/squid -k rotate endscript } /var/log/squid/cache.log { weekly rotate 5 copytruncate compress notifempty missingok }
/var/log/squid/store.log { missingok weekly compress size 200M create 0660 root squid rotate 4 # This script asks squid to rotate its logs on its own. # Restarting squid is a long process and it is not worth # doing it just to rotate logs postrotate /usr/sbin/squid -k rotate endscript }
logrotate -vvv -f /etc/logrotate.d/squid reading config file /etc/logrotate.d/squid reading config info for /var/log/squid/access.log reading config info for /var/log/squid/cache.log reading config info for /var/log/squid/store.log
Handling 3 logs
rotating pattern: /var/log/squid/access.log forced from command line (10 rotations) empty log files are rotated, old logs are removed considering log /var/log/squid/access.log log needs rotating rotating log /var/log/squid/access.log, log->rotateCount is 10 renaming /var/log/squid/access.log.10.gz to /var/log/squid/access.log.11.gz (rotatecount 10, logstart 1, i 10), old log /var/log/squid/access.log.10.gz does not exist renaming /var/log/squid/access.log.9.gz to /var/log/squid/access.log.10.gz (rotatecount 10, logstart 1, i 9), old log /var/log/squid/access.log.9.gz does not exist renaming /var/log/squid/access.log.8.gz to /var/log/squid/access.log.9.gz (rotatecount 10, logstart 1, i 8), old log /var/log/squid/access.log.8.gz does not exist renaming /var/log/squid/access.log.7.gz to /var/log/squid/access.log.8.gz (rotatecount 10, logstart 1, i 7), old log /var/log/squid/access.log.7.gz does not exist renaming /var/log/squid/access.log.6.gz to /var/log/squid/access.log.7.gz (rotatecount 10, logstart 1, i 6), old log /var/log/squid/access.log.6.gz does not exist renaming /var/log/squid/access.log.5.gz to /var/log/squid/access.log.6.gz (rotatecount 10, logstart 1, i 5), old log /var/log/squid/access.log.5.gz does not exist renaming /var/log/squid/access.log.4.gz to /var/log/squid/access.log.5.gz (rotatecount 10, logstart 1, i 4), renaming /var/log/squid/access.log.3.gz to /var/log/squid/access.log.4.gz (rotatecount 10, logstart 1, i 3), renaming /var/log/squid/access.log.2.gz to /var/log/squid/access.log.3.gz (rotatecount 10, logstart 1, i 2), renaming /var/log/squid/access.log.1.gz to /var/log/squid/access.log.2.gz (rotatecount 10, logstart 1, i 1), renaming /var/log/squid/access.log.0.gz to /var/log/squid/access.log.1.gz (rotatecount 10, logstart 1, i 0), old log /var/log/squid/access.log.0.gz does not exist log /var/log/squid/access.log.11.gz doesn't exist -- won't try to dispose of it renaming /var/log/squid/access.log to /var/log/squid/access.log.1 creating new log mode = 0660 uid = 23 gid = 23 running postrotate script compressing log with: /bin/gzip
rotating pattern: /var/log/squid/cache.log forced from command line (5 rotations) empty log files are not rotated, old logs are removed considering log /var/log/squid/cache.log log needs rotating rotating log /var/log/squid/cache.log, log->rotateCount is 5 renaming /var/log/squid/cache.log.5.gz to /var/log/squid/cache.log.6.gz (rotatecount 5, logstart 1, i 5), old log /var/log/squid/cache.log.5.gz does not exist renaming /var/log/squid/cache.log.4.gz to /var/log/squid/cache.log.5.gz (rotatecount 5, logstart 1, i 4), old log /var/log/squid/cache.log.4.gz does not exist renaming /var/log/squid/cache.log.3.gz to /var/log/squid/cache.log.4.gz (rotatecount 5, logstart 1, i 3), renaming /var/log/squid/cache.log.2.gz to /var/log/squid/cache.log.3.gz (rotatecount 5, logstart 1, i 2), renaming /var/log/squid/cache.log.1.gz to /var/log/squid/cache.log.2.gz (rotatecount 5, logstart 1, i 1), renaming /var/log/squid/cache.log.0.gz to /var/log/squid/cache.log.1.gz (rotatecount 5, logstart 1, i 0), old log /var/log/squid/cache.log.0.gz does not exist log /var/log/squid/cache.log.6.gz doesn't exist -- won't try to dispose of it copying /var/log/squid/cache.log to /var/log/squid/cache.log.1 truncating /var/log/squid/cache.log compressing log with: /bin/gzip
rotating pattern: /var/log/squid/store.log forced from command line (4 rotations) empty log files are rotated, old logs are removed considering log /var/log/squid/store.log log needs rotating rotating log /var/log/squid/store.log, log->rotateCount is 4 renaming /var/log/squid/store.log.4.gz to /var/log/squid/store.log.5.gz (rotatecount 4, logstart 1, i 4), renaming /var/log/squid/store.log.3.gz to /var/log/squid/store.log.4.gz (rotatecount 4, logstart 1, i 3), renaming /var/log/squid/store.log.2.gz to /var/log/squid/store.log.3.gz (rotatecount 4, logstart 1, i 2), renaming /var/log/squid/store.log.1.gz to /var/log/squid/store.log.2.gz (rotatecount 4, logstart 1, i 1), renaming /var/log/squid/store.log.0.gz to /var/log/squid/store.log.1.gz (rotatecount 4, logstart 1, i 0), old log /var/log/squid/store.log.0.gz does not exist renaming /var/log/squid/store.log to /var/log/squid/store.log.1 creating new log mode = 0660 uid = 0 gid = 23 running postrotate script compressing log with: /bin/gzip removing old log /var/log/squid/store.log.5.gz
The strange thing is that I get the following files:
[root@fido ~]# ls -lhtr /var/log/squid total 409M -rw-rw---- 1 root root 323M May 26 04:21 store.log.4.gz -rw-r--r-- 1 root root 12K Jun 11 15:40 squid.out -rw-r--r-- 1 root root 29M Jul 7 15:58 access.log.5.gz -rw-r----- 1 squid squid 367 Jul 8 04:22 cache.log.4.gz -rw-r--r-- 1 squid squid 28M Jul 8 04:22 access.log.4.gz -rw-r----- 1 squid squid 367 Jul 8 09:31 cache.log.3.gz -rw-r----- 1 squid squid 20 Jul 8 09:31 access.log.3.gz -rw-r----- 1 squid squid 2.9M Jul 8 09:31 store.log.3.gz -rw-r----- 1 squid squid 1.1K Jul 8 10:21 store.log.2.gz -rw-r----- 1 squid squid 367 Jul 8 10:21 cache.log.2.gz -rw-r----- 1 squid squid 3.2M Jul 8 10:21 access.log.2.gz -rw-r----- 1 squid squid 2.0K Jul 8 10:39 cache.log.1 -rw-r----- 1 squid squid 20M Jul 8 10:45 access.log.3 -rw-rw---- 1 squid squid 0 Jul 8 10:45 access.log.1 -rw-r----- 1 squid squid 3.1K Jul 8 10:45 store.log.2 -rw-rw---- 1 root squid 0 Jul 8 10:45 store.log.0 -rw-r----- 1 squid squid 359 Jul 8 10:45 cache.log.1.gz -rw-r----- 1 squid squid 0 Jul 8 10:45 cache.log.0 -rw-r----- 1 squid squid 2.2M Jul 8 10:45 access.log.1.gz -rw-r----- 1 squid squid 11K Jul 8 10:45 access.log.0 -rw-r----- 1 squid squid 1.4M Jul 8 10:45 store.log.1.gz -rw-r----- 1 squid squid 1.9K Jul 8 10:45 cache.log -rw-r----- 1 squid squid 328K Jul 8 10:46 store.log -rw-r----- 1 squid squid 957K Jul 8 10:46 access.log
I don't understand why compress old log files but doesn't delete old non-compressed files uncompressed. Any ideas? (I've also modified create parameter for squid be owner of access logs and run by hand logrotate /etc/logrotate.d/squid to see if it repeats the case)
Thanks in advance