On Sun, 6 Mar 2016 04:34, Tim Dunphy <bluethundr at ...> wrote: > Hey guys, > > I'm trying to rotate a logstash log that can grow pretty large. 3.4GB last > I saw! > > And that's because the logrotate script I came up with didn't work. > > The error I get on a syntax check is this: > > #logrotate -f logstash > size: '100M': No such file > size: '100M': No such file > size: '100M': No such file > size: '100M': No such file > size: '100M': No such file > size: '100M': No such file > size: '100M': No such file > size: '100M': No such file > > And this is the logstash rotate script: > > #cat /etc/logrotate.d/logstash > /var/log/logstash/* { > daily > rotate 7 > copytruncate > compress > delaycompress > missingok > notifempty > postrotate > size 100M > /bin/kill -HUP `cat /var/run/logstash.pid 2>/dev/null` 2> /dev/null > || true > endscript > } > > I can't find the error there. Can I have a suggestion as to what's wrong > and how to correct it? Multiple errors here, first hint: "man 8 logrotate" is a good start. Second: wrong order of lines: diff -U2 [code] --- your logstash-rotate +++ corrected logstash-rotate @@ -7,6 +7,7 @@ missingok notifempty - postrotate size 100M + sharedscripts + postrotate /bin/kill -HUP `cat /var/run/logstash.pid 2>/dev/null` 2> /dev/null || true endscript [/code] In short: "postrotate" line is in wrong position, add line "sharedscripts" - Yamaban.