Extra 'full' logs being created

General Help
1

Hi folks! I have been perusing for answers but can’t seem to figure out what may be going on. My system is filling its space with full logs. I remember it used to make logs in this format, with the date appended and would rotate every 7 days.

-rw-r--r--   1 asterisk asterisk  772 Oct 27 04:02 full-20221027

But now its doing this and creating multiple log files not rotating the logs in this format where it appends a number only and not a date.

-rw-r-----   1 asterisk asterisk 1.1G Nov  1 04:02 full.2

This is my /etc/logrotate.conf

cat /etc/logrotate.conf
# see "man logrotate" for details
# rotate log files weekly
weekly

# keep 4 weeks worth of backlogs
rotate 4

# create new (empty) log files after rotating old ones
create

# use date as a suffix of the rotated file
dateext

# uncomment this if you want your log files compressed
#compress

# RPM packages drop log rotation information into this directory
include /etc/logrotate.d

# no packages own wtmp and btmp -- we'll rotate them here
/var/log/wtmp {
    monthly
    create 0664 root utmp
        minsize 1M
    rotate 1
}

/var/log/btmp {
    missingok
    monthly
    create 0600 root utmp
    rotate 1
}

# system-specific logs may be also be configured here.
$ cat /etc/logrotate.d/asterisk
/var/log/asterisk/queue_log {
        daily
        missingok
        rotate 30
        notifempty
        sharedscripts
        create 0640 asterisk asterisk
        su asterisk asterisk
        postrotate
                /usr/sbin/asterisk -rx 'logger reload' > /dev/null 2> /dev/null
        endscript
}

/var/spool/mail/asterisk {
        daily
        missingok
        rotate 7
        notifempty
        sharedscripts
        create 0660 asterisk mail
        su asterisk mail
}

/var/log/asterisk/messages
/var/log/asterisk/event_log
/var/log/asterisk/full
/var/log/asterisk/dtmf
/var/log/asterisk/fail2ban {
        daily
        missingok
        rotate 7
        notifempty
        sharedscripts
        create 0640 asterisk asterisk
        su asterisk asterisk
        postrotate
                /usr/sbin/asterisk -rx 'logger reload' > /dev/null 2> /dev/null
        endscript
}
#This comment is to fix rpm file replacing
#Config file built on Fri Sep  3 10:23:55 UTC 2021

Thanks for any help or tips my friends!

2

look for dateext and similar renaming options

man logrotate

and add it too your ‘stanza’ , after daily is a good choice

3

Hmm well I added dateext to /etc/logrotate.d/asterisk like so

/etc/logrotate.d/asterisk
/var/log/asterisk/queue_log {
        daily
        missingok
        rotate 30
        notifempty
        sharedscripts
        create 0640 asterisk asterisk
        su asterisk asterisk
        postrotate
                /usr/sbin/asterisk -rx 'logger reload' > /dev/null 2> /dev/null
        endscript
}

/var/spool/mail/asterisk {
        daily
        missingok
        rotate 7
        notifempty
        sharedscripts
        create 0660 asterisk mail
        su asterisk mail
}

/var/log/asterisk/messages
/var/log/asterisk/event_log
/var/log/asterisk/full
/var/log/asterisk/dtmf
/var/log/asterisk/fail2ban {
        daily
        missingok
        rotate 7
        dateext          <<<<<<<<<<<<<HERE
        notifempty
        sharedscripts
        create 0640 asterisk asterisk
        su asterisk asterisk
        postrotate
                /usr/sbin/asterisk -rx 'logger reload' > /dev/null 2> /dev/null
        endscript
}

I re-ran logrotate with logrotate -f -v /etc/logrotate.d/asterisk but does not get rid of the non-date format logs. I figured maybe this is due to logrotate only looking for date appended log files now and since it sees my dated log files, it thinks it does not need to get rid of others? So I opted to just delete them for now and see if it works going forward. :person_shrugging:

4

That is correct the ‘old-named’ files remain in limbo until you do something about it, also consider moving queue_log down with it’s peers and tidily delete that stanza.

5

This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.