Logrotate – Fixing Appending Instead of Replacing Date on Filename

logrotate

I have logrotate running on a RedHat system. I changed the configuration to rotate all files in a folder daily. A few days later file listing is showing this:

login.log-20170220
login.log-20170220-20170222
login.log-20170220-20170222-20170224
login.log-20170220-20170222-20170224-20170226
login.log-20170220-20170222-20170224-20170226-20170228
login.log-20170220-20170222-20170224-20170226-20170228-20170302
login.log-20170220-20170222-20170224-20170226-20170228-20170302-20170304
login.log-20170220-20170222-20170224-20170226-20170228-20170302-20170304-20170306
login.log-20170220-20170222-20170224-20170226-20170228-20170302-20170304-20170306-20170308
login.log-20170220-20170222-20170224-20170226-20170228-20170302-20170304-20170306-20170308-20170310
login.log-20170220-20170222-20170224-20170226-20170228-20170302-20170304-20170306-20170308-20170310-20170312
login.log-20170228
login.log-20170228-20170302
login.log-20170228-20170302-20170304
login.log-20170228-20170302-20170304-20170306
login.log-20170228-20170302-20170304-20170306-20170308
login.log-20170228-20170302-20170304-20170306-20170308-20170310
login.log-20170228-20170302-20170304-20170306-20170308-20170310-20170312
login.log-20170306
login.log-20170306-20170308
login.log-20170306-20170308-20170310
login.log-20170306-20170308-20170310-20170312

I have that same setup in other systems and never had this issue… Here is the configuration in logrotate.d/

/var/log/syslog-wal/* {
    missingok
    notifempty
    create 0640 root wheel
    daily
    rotate 14
}

I find it peculiar that every 8 days there is a new round of files. Any clue of what's going on? This folder is inside of /var/log, but I didn't see anything in the other standard logrotate.d files that could explain this.

Best Answer

The pattern /var/log/syslog-wal/* matches not only login.log but also all the rotations of that log, which means that every single file will be rotated and have the date appended to their name (if the file fulfills the rotation criteria).

When run again, each of those files will have the date appended, etc.

So the solution is to just specify /var/log/syslog-wal/login.log, or possibly /var/log/syslog-wal/*.log, as the pattern.

Related Question