sonic-buildimage/files/image_config/logrotate/logrotate.d/rsyslog

# These logs should no longer get created. However, in case they do get created,
# we should keep them to a small size and rotate them also.
/var/log/mail.info
/var/log/mail.warn
/var/log/mail.err
/var/log/mail.log
/var/log/daemon.log
/var/log/kern.log
/var/log/user.log
/var/log/lpr.log
/var/log/debug
/var/log/messages
{
    size 10k
    rotate 1
    missingok
    notifempty
    compress
    delaycompress
    sharedscripts
    postrotate
        /bin/kill -HUP $(cat /var/run/rsyslogd.pid)
    endscript
}

/var/log/auth.log
/var/log/cron.log
/var/log/syslog
/var/log/teamd.log
/var/log/telemetry.log
/var/log/quagga/bgpd.log
/var/log/quagga/zebra.log
/var/log/swss/sairedis.rec
/var/log/swss/swss.rec
{
    size 1M
    rotate 5000
    missingok
    notifempty
    compress
    delaycompress
    nosharedscripts
    firstaction
        # Adjust NUM_LOGS_TO_ROTATE to reflect number of log files that trigger this block specified above
        NUM_LOGS_TO_ROTATE=8

        # Adjust LOG_FILE_ROTATE_SIZE_KB to reflect the "size" parameter specified above, in kB
        LOG_FILE_ROTATE_SIZE_KB=1024

        # Reserve space for btmp, wtmp, dpkg.log, monit.log, etc., as well as logs that
        # should be disabled, just in case they get created and rotated
        RESERVED_SPACE_KB=4096

        VAR_LOG_SIZE_KB=$(df -k /var/log | sed -n 2p | awk '{ print $2 }')

        # Limit usable space to 90% of the partition minus the reserved space for other logs
        USABLE_SPACE_KB=$(( (VAR_LOG_SIZE_KB * 90 / 100) - RESERVED_SPACE_KB))

        # Set our threshold so as to maintain enough space to write all logs from empty to full
        # Most likely, some logs will have non-zero size when this is called, so this errs on the side
        # of caution, giving us a bit of a cushion if a log grows quickly and passes its rotation size
        THRESHOLD_KB=$((USABLE_SPACE_KB - (NUM_LOGS_TO_ROTATE * LOG_FILE_ROTATE_SIZE_KB * 2)))

        # First, delete any *.1.gz files that might be left around from a prior incomplete
        # logrotate execution, otherwise logrotate will fail to do its job
        find /var/log/ -name '*.1.gz' -type f -exec rm -f {} +

        while true; do
            USED_KB=$(du -s /var/log | awk '{ print $1; }')

            if [ $USED_KB -lt $THRESHOLD_KB ]; then
                break
            else
                OLDEST_ARCHIVE_FILE=$(find /var/log -type f -printf '%T+ %p\n' | grep -E '.+\.[0-9]+(\.gz)?$' | sort | head -n 1 | awk '{ print $2; }')

                if [ -z "$OLDEST_ARCHIVE_FILE" ]; then
                    logger -p syslog.err -t "logrotate" "No archive file to delete -- potential for filling up /var/log partition!"
                    break
                fi

                logger -p syslog.info -t "logrotate" "Deleting archive file $OLDEST_ARCHIVE_FILE to free up space"
                rm -rf "$OLDEST_ARCHIVE_FILE"
            fi
        done
    endscript
    postrotate
        if [ $(echo $1 | grep -c "/var/log/swss/") -gt 0 ]; then
            pgrep -x orchagent | xargs /bin/kill -HUP 2>/dev/null || true
        else
            /bin/kill -HUP $(cat /var/run/rsyslogd.pid)
        fi
    endscript
}