About log rorate

[Michaelyang]

Hello,

I have a question
I made two settings based on the following URL
https://support.f5.com/csp/article/K13367#archive
1.   mv /etc/cron.daily/logrotate /etc/cron.monthly/
2.  tmos#modify /sys db logrotate.logage value 50

How many days will the log be rotated after this setting?
30 or 50 ?

Any help is appreciated.

[CA_Valli · Accepted solution]

Hello, it's always best to understand impacts before applying changes 🙂 

1. This changes logrotate schedule. It will run on a monthly basis now - meaning that your log files will be pretty heavy. 

2. this sets the "age" of files that are eligible for being deleted by the logrotate script. In your case, archive copies 50+ days old will be removed. 

So your log files will be:

- main log file with logs of last 31 days

- one archive copy, which has logs of 31 days ago to 62 days ago 

- every time logrotate runs (monthly), your current log file will be moved to archive copy and archive copy (which will be average 60 days old) will be removed. 

- please also remember that (as stated in KB) changes to log rotation schedule WILL NOT persist after an upgrade. Changes to file age WILL persist. 

[Michaelyang]

Hello CA_Valli,

Thank you for your teaching

Here is another question
Where will the archive copy file be placed?

Thanks a lot

[CA_Valli]

Archive copies will be in same directory /var/log, named <filename>.<1-50>.gz

[Michaelyang]

Hi CA_Valli,

If I do the setup is
1.   mv /etc/cron.monthly/logrotate /etc/cron.daily/
2.  tmos#modify /sys db logrotate.logage value 50

Does it mean that  archive copy will be stored every day, and then it will be saved for 50 days?

[CA_Valli]

Correct. Remember to run "tmsh save sys config" afterwards.