logrotate: delete tomcat/jboss logs older than n days

Question

I haven't found a solution to purge old tomcat or jboss logs or any other timestamped logs: catalog.log./server.log.. Basically these logs are rotated by jboss as: server.log, server.log.20131201, server.log.20131203 and so on.

Is there a way I can use logrotate to delete logs older than n days? I don't want to use find inside postrotate or tweak jboss/tomcat logging properties. I just want to know if logrotate can actually achieve this on it's own. I know it's not very productive but I am stuck with a problem where I need answer for this.

Resurrectionist

This answer might be helpful: #2772521 – Pollard

Hey, I know how to tweak tomcat logging to how to manage logs using crons. I used tomcat as just an example. question i have is if logrotate can take care of deletion of old timestamped files all by itself. – Resurrectionist

According to the mentioned answer: no – Pollard

The answer you have provided doesn't talk about unix logrotate, so not sure how you concliuded that. That answer talks about tomcat's own log rotation. – Resurrectionist

Answer 1

If you don't want to use find inside postrotate, no, you can't.

logrotate treats every instance of server.log rotated by Tomcat/JBoss as a different file, and since they are unique, logrotate will rotate them only once. maxage - the directive that removes rotated logs older than n days - is only checked if the logfile is to be rotated, so that maxage is only executed once and can't keep track of the file's age.

However, if you change your mind about using find, logrotate can help you simplify the management of log files created by Tomcat and JBoss. I use it to compress and remove old files with a configuration file like this:

/path/to/logs/server.log.????-??-?? {
    compress
    compresscmd /usr/bin/bzip2
    nocreate
    nodateext
    ifempty
    missingok
    rotate 1
    size 0
    start 0
    lastaction
        # Remove rotated files older than 180 days
        find /path/to/logs -name 'server.log.????-??-??.0.bz2' -mtime +180 -exec rm {} \;
    endscript
}

where:

• rotate 1 and compress rename and compress, say, server.log.20131201 to server.log.20131201.0.bz2. The 0 between the timestamp and the .bz2 extension comes from start 0.
• size 0 makes sure that files are always renamed and compressed.
• The lastaction block removes rotated files older than 180 days.

Eugene

This is such a great answer. It took me a while to find it, yet it should be at the top of my search results!! I did run into an issue with the line that start with su. I removed it from my configuration and that did not seem to cause problems. – Cornellcornelle

@Cornellcornelle I'm glad you found my answer useful, there was quite a bit of trial and error until I found a satisfactory configuration. The su keyword is only useful if, as in my case, you want the log files to be owned by the user/group that runs the application. It is confusing and I've removed it from the answer. And thanks for correcting missingok. – Eugene

what does -mtime +180 mean? – Clermontferrand

@RyanLv -mtime +180 means "modification time is more than 180 days in the past". find will match files with the name specified in the -name option that are older than 180 days. Note that UNIX-like file systems (that includes macOS and Linux) traditionally have two different reference times when dealing with changes in files: change time, which gets set every time when file status information, or more specifically, inode information, changes, and modification time, which is set when the file contents are modified. See unix.stackexchange.com/a/132661 for more information. – Eugene

Answer 2

You can put script to /etc/cron.daily. For example:

cat /etc/cron.daily/tomcat-rotate-logs

#!/bin/sh

# erasing tomcat logs older then 7 days

for x in $(find /var/log/tomcat/ -type f -mtime +7);
do
       rm "$x";
       logger -t TOMCAT-ROTATE-LOGS "Erasing $x [done]"; 
done

or create a logrotate config. For example: cat /etc/logrotate.d/tomcat

/var/log/tomcat/*.log {
        su tomcat tomcat
        copytruncate  
        daily  
        rotate 6  
        compress  
        missingok
}

"su tomcat tomcat" - stands for avoiding logrotate error on wrong permissions

Masjid

great, it too easy. to compress old log files in linux for more detail see linux.die.net/man/8/logrotate – Robson

Answer 3

logrotate can manage your logs rotating them and eventually keeping a limited number of rotated logs. But AFAIK it can do it only for logs it manages directly. If your logs are already rotated by some other agent (i.e. Tomcat itself), logrotate can't do anything, simply because does not know anything about the rotation performed by something else.

So the answer is no, you can't use logrotate to delete logs not managed by itself (and I think is not even intended to do something like that).

Gottlieb

Answer 4

Not sure if @jaume 's configuration will behave correctly with log file that is writing right now. Especially with "nocreate" option. Would like to see his comment on this point. As for me it would be easier to refuse logrotate and use just bash script in cron. Something like this:

#!/bin/bash
/usr/bin/find /path/to/logs/ -name 'server.log.????-??-??.gz' -mtime +7 -delete
/usr/bin/find /path/to/logs/ -name 'server.log.????-??-??' -mtime +1 -exec gzip -q {} \;

Jelly

Sorry, haven't seen your post till now... If the log file is being written to, my configuration will not work correctly, since rm on an open file will remove it from the directory listing but not from the file system. That is, the file will still exist and grow until Tomcat is restarted. That's why I only rotate files named server.log.????-??-??: those files have been already rotated by log4j and Tomcat is no longer writing to them. – Eugene