How To Setup Logrotate To Manage Log Files In Linux

Logrotate is a tool which is used to manage log files which have been created by system process. Logrotate automatically compress and removes the logs to maximize the convenience of logs and conserve system resources.

The most important and interesting directories in Linux is /var/log. If you see the contents of /var/log on a Linux system you will see the following log files and sub-directories.

# ls /var/log/
boot.log       cron-20170827  mail              messages           mysqld.log.rpmsave  secure-20170813   spooler-20170820  yum.log-20140101
btmp           cron-20170903  maillog           messages-20170813  mysqld.slow.log     secure-20170820   spooler-20170827  yum.log-20150101
btmp-20170901  dmesg          maillog-20170813  messages-20170820  nginx               secure-20170827   spooler-20170903  yum.log-20160102
cron           dmesg.old      maillog-20170820  messages-20170827  puppet              secure-20170903   tallylog
cron-20170813  httpd          maillog-20170827  messages-20170903  sa                  spooler           wtmp
cron-20170820  lastlog        maillog-20170903  munin              secure              spooler-20170813  yum.log

Installing Logrotate In Linux

To install logrotate type the below command:

On CentOS/Fedora/RHEL System

# yum update && yum install logrotate

On Debian/Ubuntu System

# aptitude update && aptitude install logrotate 

Logrotate Configuration Files

Find the below key files of logrotate:

/usr/sbin/logrotate

This is the logrotate command itself.

/etc/cron.daily/logrotate

This bash script executes the logrotate command everyday.

$ cat /etc/cron.daily/logrotate
#!/bin/sh

/usr/sbin/logrotate /etc/logrotate.conf
EXITVALUE=$?
if [ $EXITVALUE != 0 ]; then
    /usr/bin/logger -t logrotate "ALERT exited abnormally with [$EXITVALUE]"
fi
exit 0

/etc/logrotate.conf

Log rotation configuration for all the log files are specified in this file.

# see "man logrotate" for details
# rotate log files weekly
weekly

# keep 4 weeks worth of backlogs
rotate 4

# create new (empty) log files after rotating old ones
create

# use date as a suffix of the rotated file
dateext

# uncomment this if you want your log files compressed
#compress

# RPM packages drop log rotation information into this directory
include /etc/logrotate.d

# no packages own wtmp and btmp -- we'll rotate them here
/var/log/wtmp {
    monthly
    create 0664 root utmp
        minsize 1M
    rotate 1
}

/var/log/btmp {
    missingok
    monthly
    create 0600 root utmp
    rotate 1
}

# system-specific logs may be also be configured here.

/etc/logrotate.d

When you install a package on the system they drop the log rotation configuration information in this directory. For example httpd log rotate configuration file look like below:

# cat /etc/logrotate.d/httpd
/var/log/httpd/*log {
    missingok
    notifempty
    sharedscripts
    delaycompress
    postrotate
        /sbin/service httpd reload > /dev/null 2>/dev/null || true
    endscript
}

Rotate The Log File When File Size Reached a Specific Limit

You can logroate when if a file size reached a specific limit for example /var/log/output.log for every 512KB, configuration file look like below:

# cat logrotate.conf
/var/log/output.log {
        size 512k
        create 600 foo bar 
        rotate 4
}

Where:

• size 512K : Logrotate will run only if the file size is equal or greater then the this size.
• create : This option rotate the original file and create a new file with specified permission, user and group.
• rotate : This option limit the number of log file rotation. Here this would keep only the recent 4 rotated log files.

You can also the logroate command manually to rotate the log file, type the below command to rotate the log files.

# logrotate -s /var/log/logstatus logrotate.conf

Logrotate Copytruncate Option

Logrotate copytruncate option is used to continue to write the log information in the newly created file after rotating the old log file.

# cat logrotate.conf
/var/log/output.log {
        size 512k
        copytruncate 
        rotate 4
}

copytruncate instruct logrotate to creates the copy of the original file (i.e rotate the original log file) and truncates the original file to zero byte size. This helps the respective service that belongs to that log file can write to the proper file.

Compress The Rotated Log Files

You can also use the compression option in log rotate file, file will be compressed with gzip utility.

# cat logrotate.conf
/var/log/output.log {
        size 512k
        copytruncate
        create 600 foo bar 
        rotate 4
	compress
}

Rotate File With Date In The Log Filename

Using dateext option you can rotate the file with date in the log filename like below:

# cat logrotate.conf
/var/log/output.log {
        size 512k
        copytruncate
        create 600 foo bar 
 	dateext
        rotate 4
	compress
}

After rotate the file you will get the output in log log file.

# ls -lrt /var/log/output*

-rw-r--r--  1 foo bar 8980 2017-06-09 22:10 output.log-20170609.gz
-rwxrwxrwx 1 foo bar     0 2017-06-09 22:11 output.log

Note :- This file will rotate once in a day. When it tries to rotate next time on the same day, earlier rotated file will be having the same filename. So, the logrotate wont be successful after the first run on the same day.

Rotate The Log File On Daily, Weekly, Monthly Basis

To rotate the log file daily, weekly and monthly you can configure your file like below:

For daily:

# cat logrotate.conf
/var/log/output.log {
        daily
        copytruncate
        create 600 foo bar 
 	dateext
        rotate 4
	compress
}

For weekly:

# cat logrotate.conf
/var/log/output.log {
        weekly
        copytruncate
        create 600 foo bar 
 	dateext
        rotate 4
	compress
}

For Monthly:

# cat logrotate.conf
/var/log/output.log {
        monthly
        copytruncate
        create 600 foo bar 
 	dateext
        rotate 4
	compress
}

Execute Custom Shell Scripts Immediately After Log Rotation

You can also set your custom scripts after it completes the log file rotation. The following configuration indicates that it will execute yourscript.sh after the logrotation.

# cat logrotate.conf
/var/log/output.log {
        monthly
        copytruncate
        create 600 foo bar 
 	dateext
        rotate 4
	compress
        postrotate
               /home/santosh/yourscript.sh
        endscript
}

Remove Older Rotated Log Files

You can also configure logrotate file automatically removes the rotated files after specific number of days. In below example old rotated log files will be remove after 10 days.

# cat logrotate.conf
/var/log/output.log {
        size 512k
        copytruncate
        create 600 foo bar 
 	dateext
        rotate 4
	compress
	maxage 10
}

Ignore The Error If The Log File Missing

You can ignore the error message when the actual file is not available by using below option like below:

# cat logrotate.conf
/var/log/output.log {
        size 512k
        copytruncate
        create 600 foo bar 
 	dateext
        rotate 4
	compress
	missingok
}

Specify The Compression Type For The Log File Rotation

You can also define the compress type such as bz2 in log rotation file like below:

# cat logrotate.conf
/var/log/output.log {
        size 512k
        copytruncate
        create 600 foo bar 
 	dateext
        rotate 4
	compress
        compresscmd /bin/bzip2
        compressext .bz2
}

Where:

• compress : Indicates that compression is enabled.
• compresscmd : Indicates what type of compression command should be used, for example /bin/bzip2
• compressext : Specify the extension on the rotated log file. Without this option, the rotated file would have the default extension as .gz. So, if you use bzip2 compressioncmd, specify the extension as .bz2 as shown in the above example.

Thanks:)