Circular Logging with Logrotate in Linux

Share on Social Media

In this comprehensive guide, we will delve deep into understanding Logrotate in Linux and mastering its usage to streamline log file management on Linux systems.

What is Logrotate?

Logrotate is a utility designed to simplify the administration of log files in Linux systems. It automates the rotation, compression, removal, and mailing of log files as per specified criteria, ensuring that log files do not consume excessive disk space and are organized in a manageable manner.

Installation of Logrotate in Linux

Installing Logrotate in Linux system is a straightforward process. Simply use your distribution’s package manager to install the Logrotate package. For example, on Debian-based systems, you can install it using the following command:

sudo apt-get install logrotate

To install logrotate on Red Hat Linux based distros, you can use the package manager yum or dnf (depending on the version of Red Hat Linux, you are using). Here’s how you can do it:

sudo yum install logrotate   # For Red Hat versions 6 and older

or

sudo dnf install logrotate   # For Red Hat versions 7 and newer

Once the installation of logrotate in Linux is completed, you can verify that logrotate is installed by running:

logrotate --version

This command should display the version of logrotate command, that is installed on your Linux system.

Configuration of Logrotate

Basic Configuration

The configuration of Logrotate in Linux is primarily managed through the /etc/logrotate.conf file, along with additional configuration files located in the /etc/logrotate.d/ directory.

Let’s explore some key directives used in Logrotate configuration:

1. rotate

This directive specifies the number of rotated log files to keep. For example, rotate 7 would retain the last seven rotated log files.

2. weekly

The weekly directive determines the frequency of log rotation. Logrotate will rotate logs on a weekly basis.

3. compress

By using the compress directive, Logrotate compresses rotated log files with gzip by default, conserving disk space.

4. create

The create directive specifies the permissions and ownership of newly created log files.

5. postrotate

This directive allows you to execute custom commands or scripts after log rotation completes. It’s useful for tasks like restarting services to ensure they begin writing to the new log file.

Custom Log Rotation Configuration

In addition to the global configuration file, you can create separate configuration files for individual log files or directories within the /etc/logrotate.d/ directory. This allows for granular control over log rotation settings.

Examples of Logrotate Configuration

Example 1: Rotating a Specific Log File

/path/to/logfile.log {
    rotate 5
    weekly
    compress
    create 0644 root root
}

Example 2: Rotating All Logs in a Directory

/path/to/logs/*.log {
    rotate 10
    weekly
    compress
    create
    postrotate
        /usr/bin/systemctl restart myservice
    endscript
}

Example 3: Rotate Log and Email Previous Logfile

Here is another configuration example of logrotate in Linux that rotates a log file and sends an email with the previous log file:

/path/to/your/logfile.log {
    rotate 5              # Keep 5 rotated copies
    weekly                # Rotate logs weekly
    missingok             # If the log file is missing, don't show an error
    notifempty            # Don't rotate the log file if it's empty
    compress              # Compress rotated log files
    delaycompress         # Postpone compression until the next rotation
    create 0644 username username   # Create new log files with these permissions and ownership
    sharedscripts         # Run postrotate script only once even if multiple log files match the wildcard pattern
    postrotate
        /usr/bin/mail -s "Log Rotation Report" alaric@centlinux.com < /path/to/your/logfile.log.1
    endscript
}

Above example is more complex than prior. Therefore, you need to understand it’s each directive

  • /path/to/your/logfile.log is the path to the log file you want to rotate.
  • rotate 5 specifies that only 5 rotated copies of the log file will be kept.
  • weekly specifies that logs will be rotated weekly.
  • missingok tells logrotate to not show an error if the log file is missing.
  • notifempty instructs logrotate to not rotate the log file if it’s empty.
  • compress enables compression of rotated log files.
  • delaycompress postpones compression until the next rotation.
  • create 0644 username username specifies the permissions and ownership for newly created log files. Replace username with the appropriate username.
  • sharedscripts ensures that the postrotate script is only run once, even if multiple log files match the wildcard pattern.
  • postrotate and endscript define a script that sends an email with the previous log file using the mail command. Replace alaric@centlinux.com with your email address.

Make sure to replace placeholders like /path/to/your/logfile.log and alaric@centlinux.com with your actual log file path and email address.

Managing Logrotate with Cron

Logrotate is typically scheduled to run via a Linux cron command. By default, Logrotate in Linux configuration includes a cron job that executes daily. However, you can customize the schedule by modifying the cron configuration file (/etc/cron.daily/logrotate).

Verifying Logrotate Configuration

After configuring Logrotate in Linux, it is essential to verify that it’s functioning as expected. You can manually trigger log rotation using the following command:

sudo logrotate -vf /etc/logrotate.conf

This command will perform a verbose rotation based on the specified configuration file, allowing you to observe any errors or unexpected behavior.

Disable Logrotate Configurations

To disable all logrotate configurations, you can simply move or rename the /etc/logrotate.conf file and the entire /etc/logrotate.d/ directory. Here’s how you can do it:

To disable the main logrotate configuration file, you can either move it or rename it:

sudo mv /etc/logrotate.conf /etc/logrotate.conf.disabled

To disable all logrotate configurations stored in the /etc/logrotate.d/ directory, you can move the entire directory:

sudo mv /etc/logrotate.d/ /etc/logrotate.d.disabled/

After performing these steps, logrotate will no longer rotate any log files or directories on your system.

Remember that disabling logrotate configurations may result in log files growing indefinitely and consuming disk space, so it’s important to monitor log file sizes and manage them appropriately.

If needed, you can re-enable logrotate configurations by moving the files and directories back to their original locations.

Bonus Stuff: Logrotate Cheatsheet

Logrotate Cheatsheet

Recommended Training: Linux Command Line

Conclusion

Mastering Logrotate is crucial for efficient log file management in Linux environments. By understanding its configuration options and leveraging its capabilities, system administrators can ensure log files are appropriately managed, preventing disk space issues and facilitating easier log analysis.

Scroll to Top