Logrotate: Managing Log Files in Linux

Logs are critical for diagnosing issues within applications and the overall system. They provide insights into system operations and help pinpoint problems. However, over time, logs can accumulate and grow large, potentially causing management headaches. This is where logrotate comes into play—a powerful tool for managing and maintaining log files efficiently.

In this guide, we’ll explore how to use logrotate to keep your log files in check, ensuring they don’t consume excessive disk space while providing you with valuable insights when needed.

What is Logrotate?

Logrotate is a Linux utility designed to handle log files. It performs several important tasks:

• Rotation: It periodically renames and compresses old log files, creating new, empty log files.
• Compression: It reduces the size of rotated logs by compressing them, saving disk space.
• Removal: It deletes old log files after a specified number of rotations or based on age.
• Execution: It can execute custom scripts before or after the rotation process.

Logrotate is typically pre-installed on many Linux distributions, but if it’s not available, it can be easily installed via your package manager.

Checking the Installed Logrotate Version

To verify if logrotate is installed and check its version, use the following command:

logrotate --version

This will display the installed version of logrotate, confirming that it’s ready for use.

Locating Log Files

By default, log files are stored in the /var/log directory. To view the contents of this directory, use:

ls /var/log

This command lists all log files and directories, giving you an overview of the logs you need to manage.

logrotate --version

Configuring Logrotate

The main configuration file for logrotate is located at /etc/logrotate.conf. This file contains global settings and includes additional configuration files from /etc/logrotate.d/.

Configuration Directives

Here are some common directives used in logrotate configurations:

• daily / weekly / monthly: Specifies the frequency of log rotation.
• rotate N: Defines how many rotated log files to keep.
• compress: Compresses old log files to save space.
• delaycompress: Delays compression until the next rotation cycle.
• notifempty: Avoids rotating empty log files.
• missingok: Ignores errors if a log file is missing.
• size SIZE: Rotates the log file when it reaches a specified size.
• dateext: Adds a date extension to rotated log files.
• copytruncate: Creates a copy of the log file and truncates the original file.
• prerotate and postrotate: Executes scripts before and after rotation.

Syntax

The basic syntax for a logrotate command is:

logrotate [OPTION] config_file_path

Practical Examples

Let’s dive into some practical examples to demonstrate how logrotate can be configured and used effectively.

Example 1: Simple Logrotate Configuration

Create a log file named /var/log/test.log with sample data. Then, create a new configuration file at /etc/tmp/logrotate.conf:

sudo nano /etc/tmp/logrotate.conf

Add the following content to rotate the log file daily if it exceeds 5KB:

/var/log/test.log {
  daily
  size 5K
  su root adm
}

To check the size of the log file and perform rotation, use:

ls -l /var/log/test.log
sudo logrotate /etc/tmp/logrotate.conf
ls -l /var/log/test.log

If the file size is less than 5KB, rotation will not occur. Adjust the size to 1KB to see rotation in action.

Example 2: Using Copytruncate

To create a copy of the log file and truncate the original, modify the configuration file as follows:

/var/log/test.log {
  rotate 5
  size 1K
  copytruncate
  su root adm
}

Run logrotate and check the file size to see the effect of copytruncate:

sudo logrotate /etc/tmp/logrotate.conf
ls -l /var/log/test.log

The original file should be truncated to 0 bytes, while the new file contains the log data.

Example 3: Using Compression

To compress old log files, update your configuration:

/var/log/test.log {
  rotate 5
  size 1K
  compress
  create 770 root adm
}

After running logrotate, verify that a compressed file (e.g., test.log.1.gz) is created:

sudo logrotate /etc/tmp/logrotate.conf
ls /var/log/

Example 4: Adding Date Extensions

To include date extensions in the rotated files:

/var/log/test.log {
  su root adm
  rotate 5
  size 1K
  compress
  create 770 root adm
  dateext
}

Check the file list to see rotated logs with date extensions:

sudo logrotate /etc/tmp/logrotate.conf
ls -l /var/log/

Example 5: Using Maxage

To keep rotated logs for a specific number of days, configure:

/var/log/test.log {
  su root adm
  rotate 5
  size 1K
  compress
  maxage 1
}

This setting will remove logs older than one day. Verify with:

sudo logrotate -s=/var/log/out.log /etc/tmp/logrotate.conf

Example 6: Handling Missing Logs

To avoid errors for missing logs, add missingok:

/var/log/testfile.log {
  su root adm
  rotate 5
  size 1K
  compress
  missingok
}

If the file doesn’t exist, logrotate will proceed without errors.

Example 7: Running Scripts Before Rotation

Create a script (/home/fahmida/test.sh) to run before log rotation:

#!/bin/bash
echo "Logrotate example executed."

Make it executable:

chmod a+x /home/fahmida/test.sh

Update the configuration:

/var/log/test.log {
  su root adm
  rotate 5
  size 1K
  prerotate
  /home/fahmida/test.sh
  endscript
}

After executing logrotate, check the output of the script.

Conclusion

Logrotate is an essential tool for managing log files in Linux, providing flexibility and control over log file rotation, compression, and maintenance. By following the examples in this guide, you can tailor logrotate to fit your needs, ensuring that your log files are well-managed and that your system remains efficient and responsive.

Check out More Linux Tutorials Here!