1

I am using a script to monitor a service. I have added said script in crontab. crontab runs the script every one minute.

I have found this script online and it works pretty good, but it writes the logs to /var/mail/pi and that file does not rotate.

These are the permissions for /var/mail and /var/mail/pi : 

drwxrwsr-x  2 root mail       4096 Oct 15 13:48 mail
-rw-rw---- 1 pi   mail 1425632 Oct 15 13:49 pi

In /etc/logrotate.conf I have added:

/var/mail/pi {
    rotate 7
    daily
    su pi mail
}

Running logrotate -v /etc/logrotate.conf returns, among other rotating patterns, the following:

rotating pattern: /var/mail/pi  after 1 days (7 rotations)
empty log files are rotated, old logs are removed
switching euid to 1000 and egid to 8
error: error switching euid to 1000 and egid to 8: Operation not permitted
error: error creating output file /var/lib/logrotate/status.tmp: Permission denied

Running sudo logrotate -v /etc/logrotate.conf returns:

rotating pattern: /var/mail/pi  after 1 days (7 rotations)
empty log files are rotated, old logs are removed
switching euid to 1000 and egid to 8
considering log /var/mail/pi
  Now: 2019-10-15 14:46
  Last rotated at 2019-10-15 14:35
  log does not need rotating (log has been already rotated)
switching euid to 0 and egid to 0

Running logrotate -f /etc/logrotate.conf with or without sudo doesn't return any error regarding /var/mail/pi but only sudo logrotate -f /etc/logrotate.conf creates pi.1 and/or pi.2 and so on.

I have no idea if the rotating pattern works or not.

Improve this question
  • Take the su pi mail out. If the issue is the mode of the files it creates, use an explicit create directive to set that, or use chmod/chown in postrotate. – goldilocks♦ Oct 15 '19 at 13:05
  • @goldilocks Why remove su pi mail ? I have just checked and it made a new log file today. If I remove it, not even sudo logrotate -f /etc/logrotate.conf will work. It returns: error: skipping "/var/mail/pi" because parent directory has insecure permissions – GeorgicaFaraFrica Oct 16 '19 at 9:50
  • @goldilocks create 666 pi mail also returns skipping "/var/mail/pi" because parent directory has insecure permissions – GeorgicaFaraFrica Oct 16 '19 at 9:59
  • @goldilocks Also, how to add chmod/chown in postrotate if I don't know the name of the file ? It can be pi.1, pi.2, pi.3, pi.4, pi.5, pi.6, pi.7 ... – GeorgicaFaraFrica Oct 16 '19 at 10:04
  • You could use an appropriate wild card ("pi.*", make sure it is enclosed in quotes) -- but I was wondering why it did not work as is and just had a closer look at your question: "I have no idea if the rotating pattern works or not". You need to determine that, because if it works run sudo then it should work via system crontab (not the pi user one); if you need to ask a question, "How can I tell if logrotate is working or not?", do so, but do it on our larger sibling site, Unix & Linux. The pi is not really relevant here. – goldilocks♦ Oct 16 '19 at 13:31
1

You should look at logrotate: it's a tool designed to run as a cron job which will automatically rotate, compress, delete and mail logfiles based on the rules you write in its config file.

Here's a sample config from the man page:

/var/log/messages {
    rotate 5
    weekly
    postrotate
        /usr/bin/killall -HUP syslogd
    endscript
}

This means: every week /var/log/messages file will be compressed to something like /var/log/messages.1.gz and removed, and 5 most recent compressed log files will be kept (the old messages.1.gz will be renamed to messages.2.gz and so on). After this action, syslogd will be told to recreate a new log file.

Improve this answer
  • @GeorgicaFaraFrica if your config file says the logs should be rotated daily, they will be rotated daily regardless of how often you run logrotate. Change the current date if you want to test. Also, unless your script uses logger or similar, there is no reason to reload syslogd. If your script doesn't keep the log file open all the time (which I think is the case), you shouldn't use "postrotate" at all. – Dmitry Grigoryev Oct 15 '19 at 11:02
  • I have edited the question once again. Also, why can't I use @ and your name Dmitry Grigoryev ? – GeorgicaFaraFrica Oct 15 '19 at 12:04
  • 1
    GFF, I've just noticed that this question started out as something to which this was an answer. Right now it does not make a lot of sense because you subsequently changed the question to something about how to use logrotate. For future reference, please understand that's not how this site works: We aren't "discussion style" where a thread can morph and twist endlessly. Part of the idea is to maximize the value to posterity. Changing a question to invalidate someone's answer messes with that, and is considered seriously inconsiderate... – goldilocks♦ Oct 17 '19 at 9:25
  • 1
    ..Chaining a prolonged series of follow-up questions in comments is also generally inappropriate. It's fine to ask for clarification on a few points, but the crux of both these issues is when you have a new, distinct question, ask a new, distinct question (via "Ask Question", not comments). There is a tour that may explain all this better. WRT using @, it won't work when it is redundant, such as addressing the author of an answer in comments on that answer (because the author is notified regardless). – goldilocks♦ Oct 17 '19 at 9:25

Not the answer you're looking for? Browse other questions tagged or ask your own question.