Linux logrotate

In this example I will how to configure specific rotation settings for /var/log/messages log file

Configuration file logrotate.conf

The main configuration file is /etc/logrotate.conf, it has include /etc/logrotate.d statement to include application logs rather then system logs.

$ sudo vi /etc/logrotate.conf
#see "man logrotate" for details
weekly    #rotate log files weekly
rotate 4  #keep 4 weeks worth of backlogs
create    #create new (empty) log files after rotating old ones
dateext   #use date as a suffix of the rotated file
#compress #uncomment this if you want your log files compressed
 
include /etc/logrotate.d #RPM packages drop log rotation 
                         #information into this directory
#no packages own wtmp and btmp -- we'll rotate them here
 /var/log/wtmp {
     monthly
     create 0664 root utmp
     minsize 1M
     rotate 1
 }
 
 /var/log/btmp {
     missingok
     monthly
     create 0600 root utmp
     rotate 1
 }

logrotate Tomcat catalina.out file

$ sudo vi /etc/logrotate.d/tomcat #this file is read by 'include /etc/logrotate.d'
/{PATH_TO_CATALINA_FILE}/catalina*.* {
  daily
  rotate 7
  compress
  missingok
  size 100M
  copytruncate #truncates the original log file in place after creating a copy,
               #instead of moving the old log file and optionally creating a new one.
}

syslog rotation config

/var/log/messages log files have been rotated by general logrotate config file /etc/logrotate.d/syslog

[root@host1]# cat /etc/logrotate.d/syslog
/var/log/cron
/var/log/maillog
/var/log/messages #needs removing from multiple log rotation config
/var/log/secure
/var/log/spooler {
  sharedscripts
  postrotate
      /bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null || true
  endscript
}

root messages rotation config

Create a new config file in /etc/logrotate.d/messages for rotating /var/messages file

[root@host1]# sudo vi /etc/logrotate.d/messages
/var/log/messages {
  weekly     #required if forcing to run from -vf
  rotate 4   #required if forcing to run from -vf
  missingok
  dateext
  compress
  postrotate
    /bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null || true
  endscript 
}

Logrotate operations

/usr/sbin/logrotate -d /etc/logrotate.conf  #dry run, it show planned actions
/usr/sbin/logrotate    /etc/logrotate.conf  #log rotate everything

Force to rotate only a single file log

Force to rotate only /var/log/messages logs. -v verbose, -f force

/usr/sbin/logrotate -vf /etc/logrotate.d/messages

Logrotate options

compress

This is used to compress the rotated log file with gzip, before postrotate

nocompress

This is used when you do not want to compress rotated log files.

copytruncate

This is used when processes are still writing information to open log files. This option copies the active log file to a backup and truncates the active log file.

nocopytruncate

This copies the log files to backup, but the open log file is not truncated.

create mode owner group

This rotates the log file and creates a new log file with the specified permissions, owner, and group. The default is to use the same mode, owner, and group as the original file.

nocreate

This prevents the creation of a new log file.

missingok - don't return error if the log file is missing

delaycompress

When used with the compress option, the rotated log file is not compressed until the next time it is cycled.

nodelaycompress

This overrides delaycompress. The log file is compressed when it is cycled.

errors address

This mails logrotate errors to an address.

ifempty

With this, the log file is rotated even if it is empty. This is the default for logrotate.

notifempty

This does not rotate the log file if it is empty.

mail address

This mails log files that are cycled to an address. When mail log files are cycled, they are effectively removed from the system.

nomail

When mail log files are cycled, a copy is not mailed.

olddir directory

With this, cycled log files are kept in the specified directory. This directory must be on the same filesystem as the current log files.

noolddir

Cycled log files are kept in the same directory as the current log files.

prerotate/endscript

These are statements that enclose commands to be executed prior to a log file being rotated. The prerotateand endscript keywords must appear on a line by themselves.

postrotate/endscript

These are statements that enclose commands to be executed after a log file has been rotated. The postrotateand endscript keywords must appear on a line by themselves.

daily

This is used to rotate log files daily.

weekly

This is used to rotate log files weekly.

monthly

This is used to rotate log files monthly.

rotate count

This specifies the number of times to rotate a file before it is deleted. A count of 0 (zero) means no copies are retained. A count of 5 means five copies are retained.

tabootext [+] list

This directs logrotate to not rotate files with the specified extension. The default list of extensions is .rpm-orig, .rpmsave, v, and ~.

size size

With this, the log file is rotated when the specified size is reached. Size may be specified in bytes (default), kilobytes (sizek), or megabytes (sizem).

References

• The Ultimate Logrotate Command Tutorial with 10 Examples The geek stuff