In-depth Analysis of Logrotate File Size Limitation Configuration in Linux Systems

Analysis of Logrotate File Size Limitation Mechanisms

In Linux system administration, uncontrolled growth of log files is a primary cause of disk space exhaustion. Logrotate, as a system log management tool, offers various file size limitation options to address this challenge. The parameters size, maxsize, and minsize are three core options, each with distinct triggering logic and application scenarios.

Detailed Explanation of Core Parameters

The size parameter is the most basic size-based trigger mechanism. When configured as size 50M, rotation occurs immediately once the log file exceeds 50MB, regardless of whether the preset time period (e.g., daily, weekly) has been reached. This mechanism ignores time factors entirely, using file size as the sole criterion.

The maxsize parameter provides a more flexible triggering condition. With maxsize 50M configured, rotation triggers under two circumstances: when the file size reaches 50MB, or when the preset time period expires. This dual-trigger mechanism ensures rotation occurs at fixed intervals even if the file hasn't reached the size limit.

The minsize parameter requires both conditions to be met: the file size must reach the set value, and the time period must expire. For example, with minsize 50M daily configured, even if the file grows to 50MB within a day, rotation will only occur the next day.

Analysis of Configuration Scope

Regarding the scope of configuration, it's essential to distinguish between global settings and specific path configurations. Adding size 50M to /etc/logrotate.conf does not automatically apply to all log files, as this file primarily contains global default settings. To enforce uniform limits across all log files, corresponding configuration files need to be created in the /etc/logrotate.d/ directory.

Here is an example configuration for specific log paths:

/var/log/application/*.log {
    maxsize 50M
    hourly
    missingok
    rotate 8
    compress
    notifempty
    nocreate
}

Mathematical Modeling of Rotation Frequency

Setting appropriate rotation frequency is crucial. Assuming logs grow at a constant rate, producing 2GB of data daily, with a target maximum file size of 50MB per file. Calculations show hourly growth of approximately 83MB, meaning if rotation occurs hourly, actual file sizes will far exceed the 50MB limit.

Mathematical derivation: Daily 2GB = 2048MB, hourly growth 2048/24 ≈ 85.3MB. To ensure files don't exceed 50MB, rotation interval should be reduced to: 50/(2048/24) ≈ 0.585 hours, or approximately 35 minutes. Thus, the recommended configuration is:

*/30 * * * * /usr/sbin/logrotate /etc/logrotate.conf

System Integration and Scheduled Execution

In CentOS systems, logrotate defaults to daily execution via the /etc/cron.daily/logrotate script. For high-frequency log generation scenarios, execution frequency needs modification. This can be set directly through crontab:

*/20 * * * * /usr/sbin/logrotate /etc/logrotate.conf

Alternatively, more precise control can be achieved using systemd timers. Create the /etc/systemd/system/logrotate.timer file:

[Unit]
Description=Log Rotation Timer
[Timer]
OnCalendar=*-*-* *:0/20:00
AccuracySec=1m
Persistent=true
[Install]
WantedBy=timers.target

Practical Configuration Case Studies

Considering a web server scenario requiring simultaneous management of access and error logs:

"/var/log/httpd/access.log" /var/log/httpd/error.log {
    rotate 5
    size 100k
    sharedscripts
    postrotate
        /usr/bin/killall -HUP httpd
    endscript
}

This configuration ensures both log files rotate when exceeding 100KB, retaining 5 historical versions, and reloading the httpd process after rotation. The sharedscripts directive ensures the postrotate script executes only once, not for each file rotation.

Best Practice Recommendations

Based on operational experience, the following configuration strategies are recommended: For high-frequency log generation applications, use maxsize combined with high-frequency rotation; for systems requiring high stability, use minsize to ensure time periodicity; for critical business logs, set appropriate rotate counts and enable compress for historical files.

Monitoring mechanisms are also essential. It's advised to monitor log directory sizes through scripts, set warning thresholds, and promptly detect abnormal growth. Regularly review logrotate execution logs to ensure configurations work as expected.