Contact our honeypot department if you are desperate to get blacklisted.

Tuesday, December 27, 2011

changes in CentOS logrotate archive naming convention

It looks like the archive naming scheme used by logrotated has changed from CentOS5 to CentOS6.  For any one doing any CentOS scripting, this may affect you.  The CentOS5 logrotated simply added a ".n" to the filename, where "n" is a number.  For example:

[root@mail01-01 ~]# ls -latrh /var/log/messages*
-rw------- 1 root root 4.5M Dec 23 04:11 /var/log/messages.5.gz
-rw------- 1 root root 4.8M Dec 24 04:10 /var/log/messages.4.gz
-rw------- 1 root root 4.4M Dec 25 04:09 /var/log/messages.3.gz
-rw------- 1 root root 4.4M Dec 26 04:08 /var/log/messages.2.gz
-rw------- 1 root root 4.5M Dec 27 04:09 /var/log/messages.1.gz
-rw------- 1 root root  17M Dec 27 08:50 /var/log/messages


In CentOS6, the file name is appended with the date it was rotated.  For example:

[root@radius1 radius]# ls -latrh /var/log/messages*
-rw-------. 1 root root 2.1K Dec  4 03:45 /var/log/messages-20111204
-rw-------. 1 root root 1.8K Dec 11 03:11 /var/log/messages-20111211
-rw-------. 1 root root  33K Dec 18 03:23 /var/log/messages-20111218
-rw-------. 1 root root  438 Dec 25 03:29 /var/log/messages-20111225
-rw-------. 1 root root  281 Dec 25 21:50 /var/log/messages


This is more efficient, to be sure, as the old method would rename all the archived files to make room for the newest one, changing messages.1.gz to messages.2.gz, messages.2.gz to messages.3.gz, etc.  This may however mess up some scripts if they're looking for the ".n" pattern.