Rotate logs

Log files can grow to consume all the available disk space on the system. To avoid this problem, you can use the logrotate command to configure automatic rotation, compression, removal, and mailing of log files. Each log file can be rotated daily, weekly, monthly, or when it grows too large. The logrotate command is usually run on a regular basis via a cron job.

The configuration file for the logrotate command can be found at /etc/logrotate.conf:

Most of the lines in the picture above set options that are explained by the comments that immediately precede them. In the picture above you can see that, by default, the logs will be rotated once a week (weekly), four copies of logs will be retained (4), a new empty file will be created on every rotation (create), the old versions of log files will have a daily extension like YYYYMMDD (dateext) and compression will be disabled (#compress). The include /etc/logrotate.d directive refers to files in the /etc/logrotate.d directory that will handle specific log files.

The last few lines demonstrate the format for the definition of a specific log file:

The definitions begin with the filename for the file (/var/log/wtmp in this example), followed by an open curly brace ({). The options that follow override the defaults. For example, in the picture above, you can see that the monthly definition is set, which means that this log file will be rotated once a month. The definitions end with a closed curly brace (}).

Some individual packages store the log rotation configuration information in the /etc/logrotate.d directory. For example, here is the log rotation configuration for the Apache web server:

Here are some of the directives that can be included in a logrotate configuration file:

• compress – old versions of log files are compressed with gzip by default.
• size – sets the maximum size for a log file. It takes a size in bytes as an argument (adding k, M, or G to the size changes it to kilobytes, megabytes, or gigabytes, respectively).
• dateext – rotated log files acquire numbers by default, such as access_log.1, access_log.2…. The dateext option causes the rotated log file to obtain a date code instead, as in access_log-20140930 for the rotation performed on September 30, 2014.
• daily, weekly, monthly – rotate the log files at the specified intervals.
• missingok – ignore the error message when the actual file is not available.
• prerotate, postrotate – you can run custom shell scripts immediately before (prerotate) and after (postrotate) log rotation. The lines after these keywords are treated as scripts. The scripts end with the endscript keyword.
• mail – you can specify an email address to email a log file when it’s rotated out of existence.

For example, to rotate a log file for every 1KB, compress the rotated log files, and name the old log files with a date, we would create the file with the following directives in the /etc/logrotate.d directory:

/var/log/example_log {
size 1k
compress
dateext
}