title: When does logrotate run on RHEL 6? link: https://onemoretech.wordpress.com/2012/09/27/when-does-logrotate-run-on-rhel-6/ author: lembobro description: post_id: 3407 created: 2012/09/27 14:58:59 created_gmt: 2012/09/27 18:58:59 comment_status: closed post_name: when-does-logrotate-run-on-rhel-6 status: publish post_type: post

When does logrotate run on RHEL 6?

This isn't as simple as some might think. It is a veritable Faberge Egg in fact and an example of why you need to read the system doc for each new version of anything even if everyone says nothing has changed. Simple question right? What time does logrotate run on a RHEL 6 system? Now first of all logrotate isn't a daemon. It's really a little app (script?) that manages your system logs. How it gets run at all is that there's a script for it in the /etc/cron.daily directory.

#!/bin/sh

/usr/sbin/logrotate /etc/logrotate.conf >/dev/null 2>&1
EXITVALUE=$?
if [ $EXITVALUE != 0 ]; then
    /usr/bin/logger -t logrotate "ALERT exited abnormally with [$EXITVALUE]"
fi
exit 0

So when all those scripts get run in cron.daily is the real question we need to answer. On RHEL 5 the answer used to be that there's an entry for it in /etc/crontab. But that's not the case in RHEL 6. I know. I checked. In RHEL 6 the truth is that there's an entry for it in /etc/anacrontab.

# /etc/anacrontab: configuration file for anacron

# See anacron(8) and anacrontab(5) for details.

SHELL=/bin/sh
PATH=/sbin:/bin:/usr/sbin:/usr/bin
MAILTO=root
# the maximal random delay added to the base delay of the jobs
RANDOM_DELAY=45
# the jobs will be started during the following hours only
START_HOURS_RANGE=3-22

#period in days   delay in minutes   job-identifier   command
1       5       cron.daily              nice run-parts /etc/cron.daily
7       25      cron.weekly             nice run-parts /etc/cron.weekly
@monthly 45     cron.monthly            nice run-parts /etc/cron.monthly

Oh. Heh. So /etc/anacrontab works differently from /etc/crontab. That "START_HOURS_RANGE", in the words of the system doc, means "interval, when scheduled jobs can be run, in hours". A further note explains "In case the time interval is missed, for example due to a power failure, the scheduled jobs are not executed that day." So basically, at around 03:00 every day, give or take. There you have it then. Any questions?

Copyright 2004-2019 Phil Lembo