Master Logrotate: Automate Linux Log Management Efficiently

Log files contain valuable information about a system's internal operations and are often examined during troubleshooting or performance analysis. On busy servers, log files can grow very large quickly, consuming storage space and making manual handling difficult.

logrotate is a useful tool that can automatically rotate, compress, and delete old log files. For example, you can configure logrotate to rotate /var/log/foo every 30 days and delete records older than six months. Once configured, logrotate runs completely unattended.

In most major Linux distributions, the logrotate package is installed by default. If it is missing, you can install it with the package manager.

Debian or Ubuntu # apt-get install logrotate cron Fedora, CentOS or RHEL # yum install logrotate crontabs The main configuration file is /etc/logrotate.conf, which usually does not need modification. Individual configuration files can be placed in /etc/logrotate.d/ to define specific rotation policies.

Example 1

In this example we create a 10 MB log file /var/log/log-file and use logrotate to manage it.

# touch /var/log/log-file
# head -c 10M < /dev/urandom > /var/log/log-file

Now create a logrotate configuration for this file:

# vim /etc/logrotate.d/log-file
/var/log/log-file {
    monthly
    rotate 5
    compress
    delaycompress
    missingok
    notifempty
    create 644 root root
    postrotate
        /usr/bin/killall -HUP rsyslogd
    endscript
}

monthly : rotate logs each month (other options: daily, weekly, yearly).

rotate 5 : keep five archives; the oldest is removed when a sixth is created.

compress : compress rotated logs with gzip.

delaycompress : delay compression until the next rotation cycle.

missingok : ignore errors if the log file is missing.

notifempty : skip rotation if the log file is empty.

create 644 root root : after rotation, create a new log file with the specified permissions.

postrotate/endscript : run commands after rotation; here it forces rsyslogd to reload its configuration.

The template is generic; you can adjust parameters to suit your needs.

Example 2

This example rotates the log file only when its size exceeds 50 MB.

# vim /etc/logrotate.d/log-file
/var/log/log-file {
    size=50M
    rotate 5
    create 644 root root
    postrotate
        /usr/bin/killall -HUP rsyslogd
    endscript
}

Example 3

To name old log files with the date of rotation, add the dateext option.

# vim /etc/logrotate.d/log-file
/var/log/log-file {
    size=50M
    rotate 5
    create 644 root root
    postrotate
        /usr/bin/killall -HUP rsyslogd
    endscript
}