Master Log Rotation with logrotate: Keep Your Servers Clean and Efficient

How logrotate Works

Logrotate is typically run daily by a cron job (e.g.,

/etc/cron.daily/logrotate

). When executed, it reads its configuration files to determine which logs to rotate, how often, and how many archived copies to keep.

logrotate.conf

The main configuration file is

/etc/logrotate.conf

. It defines default parameters for all rotations and includes comments for guidance. It also contains a line such as:

<code>include /etc/logrotate.d</code>

This directory holds most application‑specific configuration files.

logrotate.d

To list the files in this directory, run:

<code>ls /etc/logrotate.d</code>

The directory may be empty or contain many files, depending on installed packages. Packages typically drop a configuration file here—for example, a syslog configuration that defines how system logs are rotated.

Note: Ubuntu versions prior to 9.10 (Karmic Koala) did not have a syslog entry; log rotation was performed by the savelog command from /etc/cron.daily/sysklogd .

Application Configuration Example

An example for Apache on a Fedora system:

<code>/var/log/httpd/*log {</code>
<code>    missingok</code>
<code>    notifempty</code>
<code>    sharedscripts</code>
<code>    postrotate</code>
<code>        /sbin/service httpd reload &gt; /dev/null 2&gt;/dev/null || true</code>
<code>    endscript</code>
<code>}</code>

When logrotate runs, it checks all non‑empty files ending with

log

under

/var/log/httpd

. If none are found, no error is raised. After processing the files, the

postrotate/endscript

block is executed, restarting Apache only once if multiple logs are rotated.

Common Directives

Use

man logrotate

for the full list. Frequently used commands include:

rotate 4

– keep four archived logs before deleting older ones.

daily

,

weekly

,

monthly

,

yearly

– set the rotation interval.

size 100M

– rotate when the log exceeds 100 MB (size overrides interval if both are set).

compress

– gzip the rotated logs.

nocompress

– disable compression for a specific block.

delaycompress

– postpone compression until the next rotation, useful when a service may still write to the old file after a restart.

postrotate … endscript

– run commands after rotation (e.g., restart a service).

sharedscripts

– ensure the

postrotate

script runs only once per block, even if multiple logs are rotated.

Sample Block with Multiple Logs

<code>/var/foo/*.log /var/bar/log.txt {</code>
<code>    rotate 14</code>
<code>    daily</code>
<code>    compress</code>
<code>    delaycompress</code>
<code>    sharedscripts</code>
<code>    postrotate</code>
<code>        /usr/sbin/apachectl graceful &gt; /dev/null</code>
<code>    endscript</code>
<code>}</code>

Where to Go Next

This overview covers logrotate’s purpose and its most useful configuration options. You should now be able to inspect existing configurations and adapt them to your needs. For examples on rotating custom virtual‑host logs, refer to sample logrotate configurations and troubleshooting resources.