Question about /var/log files

General support questions
Post Reply
Posts: 40
Joined: 2015/06/06 23:55:29

Question about /var/log files

Post by bodisha » 2019/05/19 14:40:06

I'm looking at the files under /var/log on a CentOS 7... and many of them have a date in their names (i.e. secure-20190512)... but the date in their names don't correspond to either the last message written to them... or their modification date... Which in this example were both May 10th... But the change date the stat command gives does correspond to May 12th

Can someone explain what's going on here? If the file was created and last written too on May 10th... Why does it have a May 12th date in it's name?


User avatar
Forum Moderator
Posts: 26311
Joined: 2009/09/24 10:40:56
Location: Brighton, UK

Re: Question about /var/log files

Post by TrevorH » 2019/05/19 15:15:30

Files like that are created by logrotate when it runs out of cron at about 04:00. It will name the file after the date/time that the rotate ran and won't take any notice of its contents (except to look at its size as that's one of the criteria for being eligible to be rotated).
CentOS 5 died in March 2017 - migrate NOW!
CentOS 6 goes EOL sooner rather than later, get upgrading!
Full time Geek, part time moderator. Use the FAQ Luke

Posts: 444
Joined: 2015/05/11 07:53:27
Location: UK

Re: Question about /var/log files

Post by MartinR » 2019/05/19 15:16:08

Those dates in the names correspond to when logrotate(8) "rotated" them.

Logrotate will rotate files when they are larger than the configured size, or older than the configured date. For a file which is only occasionally written to it will not normally trigger a size rotation, but eventually will become old enough for a date-based rotation. As a concrete example I have a "spooler" file that is not written to, but logrotate insists on rotating it each week. The versions I have are:

Code: Select all

-rw-------. 1 root root 0 May 19 11:27 spooler
-rw-------. 1 root root 0 Apr 21 13:43 spooler-20190428
-rw-------. 1 root root 0 Apr 28 13:33 spooler-20190505
-rw-------. 1 root root 0 May  5 13:28 spooler-20190512
-rw-------. 1 root root 0 May 12 11:31 spooler-20190519
The file's modification date reflects its creation whereas the name that logrotate is a week later, the date of rotation.

Post Reply