I know there's a cronjob that rotates the auth.log files every set amount of time but I have noticed that the auth.log.1 is small compared to the actual auth.log. Doesn't auth.log get renamed to auth.log.1 and a new auth.log created?
Yes and no:
auth.loggets renamed to
auth.log.1is not necessarily smaller than
auth.logas it depends on the usage of the machine.
E.G.: On my machine:
ll /var/log/auth* -rw-r----- 1 syslog adm 209K Nov 30 17:55 /var/log/auth.log -rw-r----- 1 syslog adm 304K Nov 25 17:08 /var/log/auth.log.1 -rw-r----- 1 syslog adm 27K Nov 18 09:20 /var/log/auth.log.2.gz -rw-r----- 1 syslog adm 16K Nov 11 07:35 /var/log/auth.log.3.gz -rw-r----- 1 syslog adm 19K Nov 5 07:35 /var/log/auth.log.4.gz
However, the other (older) logs get compressed so they're indeed smaller.
Log rotation is managed by
logrotate package, which was designed for the task.
NAME logrotate ‐ rotates, compresses, and mails system logs SYNOPSIS logrotate [-dv] [-f|--force] [-s|--state file] config_file .. DESCRIPTION logrotate is designed to ease administration of systems that generate large numbers of log files. It allows automatic rotation, compression, removal, and mailing of log files. Each log file may be handled daily, weekly, monthly, or when it grows too large. Normally, logrotate is run as a daily cron job. It will not modify a log more than once in one day unless the criterion for that log is based on the log's size and logrotate is being run more than once each day, or unless the -f or --force option is used. Any number of config files may be given on the command line. Later config files may override the options given in earlier files, so the order in which the logrotate config files are listed is important. Normally, a single config file which includes any other config files which are needed should be used. See below for more infor‐ mation on how to use the include directive to accomplish this. If a directory is given on the command line, every file in that directory is used as a config file. If no command line arguments are given, logrotate will print version and copyright information, along with a short usage summary. If any errors occur while rotating logs, logrotate will exit with non-zero status.