Comment 23 for bug 1382515

Revision history for this message
Alexander Bozhenko (alexbozhenko) wrote :

Let's do calculations:
There are around 80 files in fuel master node in /var/log/remote/fqdn/
Let's consider WORST case scenario, speed of writing to _every_ file is 100MB/hour.
Compressed 100mb log weights 4MB.
So with 4 rotations we will have 100*80 + (4*80)*4 = 9280 MB for each node.
So, for 200 nodes you need to have 2TB in /var/log/

>> We should not modify the standard logrotate schedule for /etc/logrotate.conf. This might impact host OS in an unexpected way.

As for me what is really dangerous and not supposed it to have 2 logrtate schedules.
They will meet each other every day dayly and 15-minutes schedules, and try to write to /var/lib/logrotate.status at the same time.
If we really need to run logrotate every 15 min we need to remove script from /etc/cron.daily/logrotate and run it with our schedule in /etc/cron.d, but that should be the only one logrotate run.

But do we really need to run it every 15 min?
100MB of logs is ~ 765153 lines of text. Question to mos-scale:
Have you seen speed more than 100MB per hour, even in debug mode?
I think one hour would be enough. In that case just:
mv /etc/cron.daily/logrotate /etc/cron.hourly

And this way is adviced in man. Let me quote again:
hourly Log files are rotated every hour. Note that usually logrotate is configured to be run by cron
              daily. You have to change this configuration and run logrotate hourly to be able to really
              rotate logs hourly.