I know there's a cronjob that rotates the auth.log files every set amount of time but I have noticed that the auth.log.1 is small compared to the actual auth.log. Doesn't auth.log get renamed to auth.log.1 and a new auth.log created?

  • Yes, that's how it works. – user535733 Nov 30 '18 at 16:51

Yes and no:

  • Yes, auth.log gets renamed to auth.log.1
  • No, auth.log.1 is not necessarily smaller than auth.log as it depends on the usage of the machine.

E.G.: On my machine:

ll /var/log/auth*
-rw-r----- 1 syslog adm 209K Nov 30 17:55 /var/log/auth.log
-rw-r----- 1 syslog adm 304K Nov 25 17:08 /var/log/auth.log.1
-rw-r----- 1 syslog adm  27K Nov 18 09:20 /var/log/auth.log.2.gz
-rw-r----- 1 syslog adm  16K Nov 11 07:35 /var/log/auth.log.3.gz
-rw-r----- 1 syslog adm  19K Nov  5 07:35 /var/log/auth.log.4.gz

However, the other (older) logs get compressed so they're indeed smaller.

  • 1
    "as it depends on the usage of the machine." And also depends on whether or not the machine is exposed to the internet, where there's consistent attacks from botnet mafia to break into port 22 or other services, and that can fill up the log really fast into gigabyte size. Also depends on the logging level, see the post on topic – Sergiy Kolodyazhnyy Nov 30 '18 at 21:59

Log rotation is managed by logrotate package, which was designed for the task. From man logrotate

       logrotate ‐ rotates, compresses, and mails system logs

       logrotate [-dv] [-f|--force] [-s|--state file] config_file ..

       logrotate  is  designed to ease administration of systems that generate large numbers of log files.  It allows automatic rotation, compression, removal, and mailing of
       log files.  Each log file may be handled daily, weekly, monthly, or when it grows too large.

       Normally, logrotate is run as a daily cron job.  It will not modify a log more than once in one day unless the criterion for that log is based on the  log's  size  and
       logrotate is being run more than once each day, or unless the -f or --force option is used.

       Any  number  of  config files may be given on the command line. Later config files may override the options given in earlier files, so the order in which the logrotate
       config files are listed is important.  Normally, a single config file which includes any other config files which are needed should be used.  See below for more infor‐
       mation on how to use the include directive to accomplish this.  If a directory is given on the command line, every file in that directory is used as a config file.

       If  no  command line arguments are given, logrotate will print version and copyright information, along with a short usage summary.  If any errors occur while rotating
       logs, logrotate will exit with non-zero status.
  • Facepalm! Not cron! logrotate!!! +1 – Fabby Nov 30 '18 at 22:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.