Configure logrotate on Redhat Linux

Logrotate is a utility designed for administrators who manage servers that produce a high volume of log files. It helps them save some disk space, as well as to avoid a potential risk of making a system unresponsive due to the lack of disk space.

Normally, a solution to avoid this kind of problem is to setup a separate partition or logical volume for a /var mount point. However, logrotate may also be a viable solution to this problem, especially if it is too late to move all logs under different partition.

In this tutorial, we will show how to configure the logrotate service on Red Hat Enterprise Linux, so you can take log files back under your control.

In this tutorial you will learn:

  • How to use the logrotate utility on RHEL
  • Where the logrotate configuration files are stored
  • How to set up a custom logrotate configuration
  • How to test a logrotate implementation
Configure logrotate on Red Hat Linux
Configure logrotate on Red Hat Linux
Software Requirements and Linux Command Line Conventions
Category Requirements, Conventions or Software Version Used
System Red Hat Enterprise Linux
Software logrotate
Other Privileged access to your Linux system as root or via the sudo command.
Conventions # – requires given linux commands to be executed with root privileges either directly as a root user or by use of sudo command
$ – requires given linux commands to be executed as a regular non-privileged user

What is logrotate?



Twitter icon Follow LinuxConfig.org on Twitter for the latest tips and tricks about Linux!


Logrotate provides an ability for a system administrator to systematically rotate and archive any log files produced by the system and thus reducing a operating system’s disk space requirement. By default, logrotate is invoked once a day using a cron scheduler from the location /etc/cron.daily/.

# ls /etc/cron.daily/
cups  logrotate  makewhatis.cron  mlocate.cron  prelink  readahead.cron  rhsmd  tmpwatch

Configuring logrotate

Logrotate’s configuration is done by editing two separate configuration files:

  • /etc/logrotate.conf
  • service specific configuration files stored in /etc/logrotate.d/

The main logrotate.conf file contains a generic configuration. Here is a default logrotate configuration file logrotate.conf:

  weekly
  rotate 4
  create
  dateext
  include /etc/logrotate.d
  /var/log/wtmp {
      monthly
      create 0664 root utmp
          minsize 1M
      rotate 1
  }
  • Line 1 – weekly configuration option ensures a weekly rotation of all log-files defined in main configuration file and in /etc/logrotate.d/ directory.
  • Line 2 – rotate 4 ensures that logrotate keeps a 4 weeks backup of all log files
  • Line 3 – create option instructs logrotate to create new empty log files after each rotation
  • Line 4 – dateext appends an extension to all rotated log files in form of date when each particular log file was processed by logrotate
  • Line 5 – include all other configuration from directory /etc/logrotate.d
  • Line 6 – 11 contains a specific service log rotate configuration

As opposed to logrotate.conf, a directory /etc/logrotate.d/ contains a specific service configuration files used by logrotate. In the next section we will create a sample skeleton logrotate configuration.

Including new service logs to logrotate

In this section we will add new log file into a logrotate configuration. Let’s say that we have a log file called /var/log/linuxserver.log, sitting in our /var/log directory that needs to be rotated on daily basis.

First we need to create a new logrotate configuration file to accommodate for our new log file:

# vi /etc/logrotate.d/linuxserver

Insert the following text into /etc/logrotate.d/linuxserver:



/var/log/linuxserver.log {
        rotate 7
        daily
        compress
        delaycompress
        missingok
        notifempty
        create 660 linuxuser linuxuser }

This config file will run daily, create a maximum of 7 archives owned by linuxuser and linuxuser group with 660 permissions, compress all logs and exclude only yesterdays and empty log files. Here are some selected logrotate configuration keywords. For a complete tutorial, check the logrotate man page.

daily Log files are rotated every day.
weekly Log files are rotated if the current weekday is less than the weekday of the last rotation or if more than a week has passed since the last rotation. This is normally the same as rotating logs on the first day of the week, but if logrotate is not being run every night a log rotation will happen at the first valid opportunity.
monthly Log files are rotated the first time logrotate is run in a month (this is normally on the first day of the month).
notifempty Do not rotate the log if it is empty (this overrides the ifempty option).
nocompress Old versions of log files are not compressed.
delaycompress Postpone compression of the previous log file to the next rotation cycle. This only has effect when used in combination with compress. It can be used when some program cannot be told to close its logfile and thus might continue writing to the previous log file for some time.
compress Old versions of log files are compressed with gzip by default.
mail address When a log is rotated out of existence, it is mailed to address. If no mail should be generated by a particular log, the nomail directive may be used.
missingok If the log file is missing, go on to the next one without issuing an error message.

Once your config file is ready, just simply copy it into the logrotate directory and change owner and permissions:

# cp linuxserver /etc/logrotate.d/
# chmod 644 /etc/logrotate.d/linuxserver
# chown root.root /etc/logrotate.d/linuxserver

Testing a new Logrotate configuration

Now that the logrotate config has been implemented, follow the steps below to test it out.



  1. Create some sample log file, if it doesn’t already exist:
    # echo "rotate my log file" > /var/log/linuxserver.log
    
  2. Once your log file is in place, force logrotate to rotate all logs with -f option.
    # logrotate -f /etc/logrotate.conf
    

    Warning: The above command will rotate all your logs defined in /etc/logrotate.d directory.

  3. Now visit again your /var/log/directory and confirm that your log file was rotated and new log file was created.

Closing Thoughts

As it was already mentioned previously, the best way to avoid your system being clogged by log files is to create a separate partition/logical volume for your /var/ or even better /var/log directory. However, even then logrotate can help you to save some disk space by compressing your log files. Logrotate may also help you to archive your log files for a future reference by creating an extra copy or by emailing you any newly rotated log files.