Need help in understanding logrotate behavior

Question

/etc/logrotate.conf says rotate logs "weekly"

/etc/logrotate.d/ssh says

/var/log/ssh.log {
compress
dateext
maxage 120
rotate 99
missingok
notifempty
size +4096k
create 640 root p4admin
sharedscripts
postrotate
/etc/init.d/syslog reload
endscript
}

/var/lib/logrotate.status says last rotated ssh on "/var/log/ssh.log" 2013-1-4

But the above don't match the data we see on the files...

-rw-r----- 1 root user 201M Jan 4 09:47 /var/log/ssh.log
-rw-r----- 1 root user 65M Oct 19 04:02 /var/log/ssh.log-20121019.gz
-rw-r----- 1 root user 64M Nov 28 04:02 /var/log/ssh.log-20121128.gz
-rw-r----- 1 root user 63M Oct 23 04:02 /var/log/ssh.log-20121023.gz

Any idea, What am I missing?

Answer 1

• weekly in your /etc/logrotate.conf means all your log files will be rotated weekly, if this option is not overridden locally.

  The manual says:

  Each configuration file can set global options (local definitions over-
  ride global ones, and later  definitions  override  earlier  ones)  and
  specify  logfiles  to  rotate.
  

• If the size option is used, logrotate will ignore the daily, weekly, monthly, and yearly options as stated here

• logrotate is executed daily in order to check criterion such as the size. Logs are rotated at the same time if applicable.

  The manual says:

  Normally, logrotate is run as a daily cron job.  It will not  modify  a
  log  multiple  times  in  one  day unless the criterion for that log is
  based on the log's size and logrotate is being run multiple times  each
  day, or unless the -f or --force option is used.
  

Therefore, logrotate checks the size of your log everyday and it performs the rotation if necessary.