[CentOS] Problem with logrotate and compress

Tue Jul 8 13:48:34 UTC 2008
Sergio Belkin <sebelk at gmail.com>

Hi I am using Centos 5.1 and I have a weird problem with squid logs
rotation. I have the file squid as follow in /etc/logrotate.d:

Recently I reduce size parameter.

/var/log/squid/access.log {
   weekly
   missingok
   rotate 10
   compress
   create 0660 squid squid
   missingok
   size 200M
   postrotate
     /usr/sbin/squid -k rotate
   endscript
}
/var/log/squid/cache.log {
   weekly
   rotate 5
   copytruncate
   compress
   notifempty
   missingok
}

/var/log/squid/store.log {
         missingok
         weekly
         compress
         size 200M
         create 0660 root squid
         rotate 4
# This script asks squid to rotate its logs on its own.
# Restarting squid is a long process and it is not worth
# doing it just to rotate logs
   postrotate
     /usr/sbin/squid -k rotate
   endscript
}


logrotate -vvv -f  /etc/logrotate.d/squid
reading config file /etc/logrotate.d/squid
reading config info for /var/log/squid/access.log
reading config info for /var/log/squid/cache.log
reading config info for /var/log/squid/store.log

Handling 3 logs

rotating pattern: /var/log/squid/access.log  forced from command line
(10 rotations)
empty log files are rotated, old logs are removed
considering log /var/log/squid/access.log
  log needs rotating
rotating log /var/log/squid/access.log, log->rotateCount is 10
renaming /var/log/squid/access.log.10.gz to
/var/log/squid/access.log.11.gz (rotatecount 10, logstart 1, i 10),
old log /var/log/squid/access.log.10.gz does not exist
renaming /var/log/squid/access.log.9.gz to
/var/log/squid/access.log.10.gz (rotatecount 10, logstart 1, i 9),
old log /var/log/squid/access.log.9.gz does not exist
renaming /var/log/squid/access.log.8.gz to
/var/log/squid/access.log.9.gz (rotatecount 10, logstart 1, i 8),
old log /var/log/squid/access.log.8.gz does not exist
renaming /var/log/squid/access.log.7.gz to
/var/log/squid/access.log.8.gz (rotatecount 10, logstart 1, i 7),
old log /var/log/squid/access.log.7.gz does not exist
renaming /var/log/squid/access.log.6.gz to
/var/log/squid/access.log.7.gz (rotatecount 10, logstart 1, i 6),
old log /var/log/squid/access.log.6.gz does not exist
renaming /var/log/squid/access.log.5.gz to
/var/log/squid/access.log.6.gz (rotatecount 10, logstart 1, i 5),
old log /var/log/squid/access.log.5.gz does not exist
renaming /var/log/squid/access.log.4.gz to
/var/log/squid/access.log.5.gz (rotatecount 10, logstart 1, i 4),
renaming /var/log/squid/access.log.3.gz to
/var/log/squid/access.log.4.gz (rotatecount 10, logstart 1, i 3),
renaming /var/log/squid/access.log.2.gz to
/var/log/squid/access.log.3.gz (rotatecount 10, logstart 1, i 2),
renaming /var/log/squid/access.log.1.gz to
/var/log/squid/access.log.2.gz (rotatecount 10, logstart 1, i 1),
renaming /var/log/squid/access.log.0.gz to
/var/log/squid/access.log.1.gz (rotatecount 10, logstart 1, i 0),
old log /var/log/squid/access.log.0.gz does not exist
log /var/log/squid/access.log.11.gz doesn't exist -- won't try to dispose of it
renaming /var/log/squid/access.log to /var/log/squid/access.log.1
creating new log mode = 0660 uid = 23 gid = 23
running postrotate script
compressing log with: /bin/gzip

rotating pattern: /var/log/squid/cache.log  forced from command line
(5 rotations)
empty log files are not rotated, old logs are removed
considering log /var/log/squid/cache.log
  log needs rotating
rotating log /var/log/squid/cache.log, log->rotateCount is 5
renaming /var/log/squid/cache.log.5.gz to
/var/log/squid/cache.log.6.gz (rotatecount 5, logstart 1, i 5),
old log /var/log/squid/cache.log.5.gz does not exist
renaming /var/log/squid/cache.log.4.gz to
/var/log/squid/cache.log.5.gz (rotatecount 5, logstart 1, i 4),
old log /var/log/squid/cache.log.4.gz does not exist
renaming /var/log/squid/cache.log.3.gz to
/var/log/squid/cache.log.4.gz (rotatecount 5, logstart 1, i 3),
renaming /var/log/squid/cache.log.2.gz to
/var/log/squid/cache.log.3.gz (rotatecount 5, logstart 1, i 2),
renaming /var/log/squid/cache.log.1.gz to
/var/log/squid/cache.log.2.gz (rotatecount 5, logstart 1, i 1),
renaming /var/log/squid/cache.log.0.gz to
/var/log/squid/cache.log.1.gz (rotatecount 5, logstart 1, i 0),
old log /var/log/squid/cache.log.0.gz does not exist
log /var/log/squid/cache.log.6.gz doesn't exist -- won't try to dispose of it
copying /var/log/squid/cache.log to /var/log/squid/cache.log.1
truncating /var/log/squid/cache.log
compressing log with: /bin/gzip

rotating pattern: /var/log/squid/store.log  forced from command line
(4 rotations)
empty log files are rotated, old logs are removed
considering log /var/log/squid/store.log
  log needs rotating
rotating log /var/log/squid/store.log, log->rotateCount is 4
renaming /var/log/squid/store.log.4.gz to
/var/log/squid/store.log.5.gz (rotatecount 4, logstart 1, i 4),
renaming /var/log/squid/store.log.3.gz to
/var/log/squid/store.log.4.gz (rotatecount 4, logstart 1, i 3),
renaming /var/log/squid/store.log.2.gz to
/var/log/squid/store.log.3.gz (rotatecount 4, logstart 1, i 2),
renaming /var/log/squid/store.log.1.gz to
/var/log/squid/store.log.2.gz (rotatecount 4, logstart 1, i 1),
renaming /var/log/squid/store.log.0.gz to
/var/log/squid/store.log.1.gz (rotatecount 4, logstart 1, i 0),
old log /var/log/squid/store.log.0.gz does not exist
renaming /var/log/squid/store.log to /var/log/squid/store.log.1
creating new log mode = 0660 uid = 0 gid = 23
running postrotate script
compressing log with: /bin/gzip
removing old log /var/log/squid/store.log.5.gz


The strange thing is that I get the following files:

[root at fido ~]# ls -lhtr /var/log/squid
total 409M
-rw-rw---- 1 root  root  323M May 26 04:21 store.log.4.gz
-rw-r--r-- 1 root  root   12K Jun 11 15:40 squid.out
-rw-r--r-- 1 root  root   29M Jul  7 15:58 access.log.5.gz
-rw-r----- 1 squid squid  367 Jul  8 04:22 cache.log.4.gz
-rw-r--r-- 1 squid squid  28M Jul  8 04:22 access.log.4.gz
-rw-r----- 1 squid squid  367 Jul  8 09:31 cache.log.3.gz
-rw-r----- 1 squid squid   20 Jul  8 09:31 access.log.3.gz
-rw-r----- 1 squid squid 2.9M Jul  8 09:31 store.log.3.gz
-rw-r----- 1 squid squid 1.1K Jul  8 10:21 store.log.2.gz
-rw-r----- 1 squid squid  367 Jul  8 10:21 cache.log.2.gz
-rw-r----- 1 squid squid 3.2M Jul  8 10:21 access.log.2.gz
-rw-r----- 1 squid squid 2.0K Jul  8 10:39 cache.log.1
-rw-r----- 1 squid squid  20M Jul  8 10:45 access.log.3
-rw-rw---- 1 squid squid    0 Jul  8 10:45 access.log.1
-rw-r----- 1 squid squid 3.1K Jul  8 10:45 store.log.2
-rw-rw---- 1 root  squid    0 Jul  8 10:45 store.log.0
-rw-r----- 1 squid squid  359 Jul  8 10:45 cache.log.1.gz
-rw-r----- 1 squid squid    0 Jul  8 10:45 cache.log.0
-rw-r----- 1 squid squid 2.2M Jul  8 10:45 access.log.1.gz
-rw-r----- 1 squid squid  11K Jul  8 10:45 access.log.0
-rw-r----- 1 squid squid 1.4M Jul  8 10:45 store.log.1.gz
-rw-r----- 1 squid squid 1.9K Jul  8 10:45 cache.log
-rw-r----- 1 squid squid 328K Jul  8 10:46 store.log
-rw-r----- 1 squid squid 957K Jul  8 10:46 access.log

I don't understand why compress old log files but doesn't delete old
non-compressed files uncompressed. Any ideas? (I've also modified
create parameter for squid be owner of access logs and run by hand
logrotate /etc/logrotate.d/squid to see if it repeats the case)

Thanks in advance
-- 
--
Open Kairos http://www.openkairos.com
Watch More TV http://sebelk.blogspot.com
Sergio Belkin -