======OS - Linux - Logrotate======

=====Notes=====

Force a verbose logrotate run:
<code>
sudo logrotate -fv /etc/logrotate.conf
</code>

====Not rotating /var/log/syslog====

/var/log/syslog is not being rotated.

A forced run of logrotate shows the following for syslog:
<code>
rotating pattern: /var/log/syslog
 forced from command line (7 rotations)
empty log files are not rotated, old logs are removed
considering log /var/log/syslog
  log needs rotating
rotating log /var/log/syslog, log->rotateCount is 7
dateext suffix '-20160630'
glob pattern '-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]'
compressing log with: /bin/gzip
error: error creating output file /var/log/syslog.1.gz: File exists
log /var/log/syslog.8.gz doesn't exist -- won't try to dispose of it
</code>

Check to see if /var/log/syslog.1.gz is 0 KB. \\
If so, delete it and syslog rotation should now work.

Source: [[http://raspberrypi.stackexchange.com/questions/22545/why-are-system-logs-not-rotating|Raspberry Pi Stack Exchange - raspbian - Why are system logs not rotating?]] \\

====Not rotating a custom log====

A forced run of logrotate shows:
<code>
error: /etc/logrotate.conf:35 unknown group 'group1'
</code>

And:
<code>
error: found error in /var/log/custom.log , skipping
</code>

Check if a 'create' is used in the logrotate configuration:
<code>
create 0664 user1 group1
</code>

And check if both the user and group exist, and modify the create to use a user and group that exists. (In this case the group did not exist.)