Logrotate is a utility designed for administrators who manage servers that produce a high volume of log files. It helps them save some disk space, as well as to avoid a potential risk of making a system unresponsive due to the lack of disk space.
Normally, a solution to avoid this kind of problem is to setup a separate partition or logical volume for a /var mount point. However, logrotate may also be a viable solution to this problem, especially if it is too late to move all logs under different partition.
In this tutorial, we will show how to configure the logrotate service on Red Hat Enterprise Linux, so you can take log files back under your control.
In this tutorial you will learn:
- How to use the logrotate utility on RHEL
- Where the logrotate configuration files are stored
- How to set up a custom logrotate configuration
- How to test a logrotate implementation
| Category | Requirements, Conventions or Software Version Used |
|---|---|
| System | Red Hat Enterprise Linux |
| Software | logrotate |
| Other | Privileged access to your Linux system as root or via the sudo command. |
| Conventions | # – requires given linux commands to be executed with root privileges either directly as a root user or by use of sudo command$ – requires given linux commands to be executed as a regular non-privileged user |
What is logrotate?
Logrotate provides an ability for a system administrator to systematically rotate and archive any log files produced by the system and thus reducing a operating system’s disk space requirement. By default, logrotate is invoked once a day using a cron scheduler from the location
/etc/cron.daily/.
# ls /etc/cron.daily/ cups logrotate makewhatis.cron mlocate.cron prelink readahead.cron rhsmd tmpwatch
Configuring logrotate
Logrotate’s configuration is done by editing two separate configuration files:
- /etc/logrotate.conf
- service specific configuration files stored in /etc/logrotate.d/
The main logrotate.conf file contains a generic configuration. Here is a default logrotate configuration file logrotate.conf:
weekly
rotate 4
create
dateext
include /etc/logrotate.d
/var/log/wtmp {
monthly
create 0664 root utmp
minsize 1M
rotate 1
}
- Line 1 – weekly configuration option ensures a weekly rotation of all log-files defined in main configuration file and in /etc/logrotate.d/ directory.
- Line 2 – rotate 4 ensures that logrotate keeps a 4 weeks backup of all log files
- Line 3 – create option instructs logrotate to create new empty log files after each rotation
- Line 4 – dateext appends an extension to all rotated log files in form of date when each particular log file was processed by logrotate
- Line 5 – include all other configuration from directory /etc/logrotate.d
- Line 6 – 11 contains a specific service log rotate configuration
As opposed to logrotate.conf, a directory /etc/logrotate.d/ contains a specific service configuration files used by logrotate. In the next section we will create a sample skeleton logrotate configuration.
Including new service logs to logrotate
In this section we will add new log file into a logrotate configuration. Let’s say that we have a log file called /var/log/linuxserver.log, sitting in our /var/log directory that needs to be rotated on daily basis.
First we need to create a new logrotate configuration file to accommodate for our new log file:
# vi /etc/logrotate.d/linuxserver
Insert the following text into /etc/logrotate.d/linuxserver:
/var/log/linuxserver.log {
rotate 7
daily
compress
delaycompress
missingok
notifempty
create 660 linuxuser linuxuser }
This config file will run daily, create a maximum of 7 archives owned by linuxuser and linuxuser group with 660 permissions, compress all logs and exclude only yesterdays and empty log files. Here are some selected logrotate configuration keywords. For a complete tutorial, check the logrotate man page.
| daily | Log files are rotated every day. |
| weekly | Log files are rotated if the current weekday is less than the weekday of the last rotation or if more than a week has passed since the last rotation. This is normally the same as rotating logs on the first day of the week, but if logrotate is not being run every night a log rotation will happen at the first valid opportunity. |
| monthly | Log files are rotated the first time logrotate is run in a month (this is normally on the first day of the month). |
| notifempty | Do not rotate the log if it is empty (this overrides the ifempty option). |
| nocompress | Old versions of log files are not compressed. |
| delaycompress | Postpone compression of the previous log file to the next rotation cycle. This only has effect when used in combination with compress. It can be used when some program cannot be told to close its logfile and thus might continue writing to the previous log file for some time. |
| compress | Old versions of log files are compressed with gzip by default. |
| mail address | When a log is rotated out of existence, it is mailed to address. If no mail should be generated by a particular log, the nomail directive may be used. |
| missingok | If the log file is missing, go on to the next one without issuing an error message. |
Once your config file is ready, just simply copy it into the logrotate directory and change owner and permissions:
# cp linuxserver /etc/logrotate.d/ # chmod 644 /etc/logrotate.d/linuxserver # chown root.root /etc/logrotate.d/linuxserver
Testing a new Logrotate configuration
Now that the logrotate config has been implemented, follow the steps below to test it out.
- Create some sample log file, if it doesn’t already exist:
# echo "rotate my log file" > /var/log/linuxserver.log
- Once your log file is in place, force logrotate to rotate all logs with
-foption.# logrotate -f /etc/logrotate.conf
Warning: The above command will rotate all your logs defined in
/etc/logrotate.ddirectory. - Now visit again your /var/log/directory and confirm that your log file was rotated and new log file was created.
Closing Thoughts
As it was already mentioned previously, the best way to avoid your system being clogged by log files is to create a separate partition/logical volume for your /var/ or even better /var/log directory. However, even then logrotate can help you to save some disk space by compressing your log files. Logrotate may also help you to archive your log files for a future reference by creating an extra copy or by emailing you any newly rotated log files.