Rotating Logs on Linux

Introduction

Log files on linux grow on a daily basis and quickly become very big. You don't need to do complex scripts in order to automate rotation, removal, compression and mailing of log files cause linux provides an usefull tool to do that.

Logrotate is a tool for large amounts of log files and helps you to manage these files and control their growth.

Normally, logrotate is run as a daily cron job (it's scheduled into /etc/cron.daily/logrotate). It will not modify a log multiple times in one day unless the criterium for that log is based on the log’s size and logrotate is being run multiple times each day, or unless the -f or -force option is used.

Synopsis

logrotate [-dv] [-f|--force] [-s|--state file] config_file ..

Options

      -d, --debug
             Turns on debug mode and implies -v.  In debug mode, no changes will be made to the logs or to the logrotate state file.

      -f, --force
             Tells  logrotate  to force the rotation, even if it doesn’t think this is necessary.  Sometimes this is useful after adding new 
             entries to a logrotate config file, or if old log files have been removed by hand, as the new files will be created, and logging 
             will continue correctly.

      -m, --mail <command>
             Tells  logrotate which command to use when mailing logs. This command should accept two arguments: 1) the subject of the message, 
             and 2) the recipient. The command must then read a message on standard input and mail it to the recipient. 
             The default mail command is /bin/mail -s.

      -s, --state <statefile>
             Tells logrotate to use an alternate state file.  This is useful if logrotate is being run as a different user for various sets of
             log files.
             The default state file is /var/lib/logrotate.status.

      --usage
             Prints a short usage message.

      -?, --help
             Prints help message.

      -v, --verbose Turns on verbose mode.

Configuration file

The main configuration file is /etc/logrotate.conf. Here it's an example.

[root@localhost ~]# more /etc/logrotate.conf 
# see "man logrotate" for details
# rotate log files weekly
weekly
 
# keep 4 weeks worth of backlogs
rotate 4
 
# create new (empty) log files after rotating old ones
create
 
# use date as a suffix of the rotated file
dateext
 
# uncomment this if you want your log files compressed
#compress
 
# RPM packages drop log rotation information into this directory
include /etc/logrotate.d
 
# no packages own wtmp and btmp -- we'll rotate them here
/var/log/wtmp {
    monthly
    create 0664 root utmp
	minsize 1M
    rotate 1
}
 
/var/log/btmp {
    missingok
    monthly
    create 0600 root utmp
    rotate 1
}
 
# system-specific logs may be also be configured here.

The first few lines set global options; in the example, logs are rotated weekly, maintain 4 old logs after this is 4 old logs, the create option is for create a new log file after rotate the old one, dateext archive old versions of log files adding a daily extension like YYYYMMDD instead of simply adding a number. The extension may be configured using the dateformat option. Note that comments may appear anywhere in the config file as long as the first non-whitespace character on the line is a #.

One interesting option is the include. We can put a file or a directory after the include option. If a directory is given, most of the files in that directory are read in alphabetic order before processing of the including file continues. The only files which are ignored are files which are not regular files (such as directories and named pipes) and files whose names end with one of the taboo extensions, as spec-ified by the tabooext directive. The include directive may not appear inside a log file definition. In the example:

include /etc/logrotate.d

The configuration files that are into /etc/logrotate.d directory will be readed and executed by logrotate.

Configuration file example

Lets take a look for a configuration that we have create in order to rotate /home/oracle/Escritorio/logs/pruebalog.log. We have to place the configuration file into /etc/logrotate.d directory.

[root@localhost logrotate.d]# cd /etc/logrotate.d/
[root@localhost logrotate.d]# pwd
/etc/logrotate.d
[root@localhost logrotate.d]# cat pruebalog 
# Logrotate file for /home/oracle/Escritorio/logs
 
/home/oracle/Escritorio/logs/pruebalog.log {
	copytruncate
	compress
	delaycompress
	notifempty
	size 100k
	rotate 5
}

We are using the following options for rotate /home/oracle/Escritorio/logs/pruebalog.log, note that the options that we put on this file overrides the options that are placed on the main configuration file /etc/logrotate.conf.

copytruncate
Truncate the original log file in place after creating a copy, instead of moving the old log file and optionally creating a new one.
It can be used when some program cannot be told to close its logfile and thus might continue writing (appending) to the previous log
file forever.
Note that there is a very small time slice between copying the file and truncating it, so some logging data might be lost. When this
option is used, the create option will have no effect, as the old log file stays in place.
compress
Old versions of log files are compressed with gzip(1) by default. See also nocompress.
delaycompress
Postpone compression of the previous log file to the next rotation cycle. This only has effect when used in combination with compress.
It can be used when some program cannot be told to close its logfile and thus might continue writing to the previous log file for some
time.
notifempty
Do not rotate the log if it is empty (this overrides the ifempty option).
size size
Log files are rotated only if they grow bigger then size bytes. If size is followed by k, the size is assumed to be in kilobytes.
If the M is used, the size is in megabytes, and if G is used, the size is in gigabytes. So size 100, size 100k, size 100M and size
100G are all valid.
rotate count
Log files are rotated count times before being removed or mailed to the address specified in a mail directive. If count is 0, old
versions are removed rather than rotated.

More options can be used see man logrotate for more options.

Now lets take a look how the /home/oracle/Escritorio/prueba.log file is rotated.

[root@localhost logrotate.d]# ls -hlrt /home/oracle/Escritorio/logs/
total 304K
-rw-rw-r--. 1 oracle oracle  333 nov  8 09:32 pruebalog.log.2.gz
-rw-rw-r--. 1 oracle oracle 300K nov  8 09:32 pruebalog.log.1
-rw-rw-r--. 1 oracle oracle    0 nov  8 09:32 pruebalog.log

As we can see there are some files into the directory, the log file pruebalog.log that is the log file in use, once the rotatelog command is executed throught the command line or executed by cron if the prueba.log file size is greater than 100K the file is rotated. We have pruebalog.log.1 that is the first rotation, the file is not compressed due to the delaycompress option in the configuration file. We have pruebalog.log.2.gz that is the second rotation as we can see the file is compressed cause is the second rotation and delaycompress option doesn't affect to the second rotation.

If you enjoyed this article, you might also like

Comments

blog comments powered by Disqus

Rotating Logs on Linux

Contents

Introduction

Synopsis

Options

Configuration file

Configuration file example

If you enjoyed this article, you might also like

Comments

Personal tools

Namespaces

Variants

Views

Actions

Search

Navigation

Toolbox

Categories