Master Logrotate: Automate Log Management and Prevent Disk Exhaustion on Linux

Introduction

Log files contain valuable information about system events and are essential for troubleshooting and performance analysis. On busy servers, log files can grow rapidly, consuming disk space and becoming difficult to manage.

Installing Logrotate

Logrotate is included by default on most Linux distributions. If it is missing, install it with the package manager: # apt-get install logrotate cron or

# yum install logrotate crontabs

Configuration Files

The main configuration file is /etc/logrotate.conf, which rarely needs modification. Individual log rotation rules are placed in separate files under /etc/logrotate.d/.

Example 1 – Simple Size‑Based Rotation

Create a 10 MB test log file and configure logrotate to rotate it monthly, keeping five archives and compressing old ones.

# touch /var/log/log-file
# head -c 10M /dev/urandom > /var/log/log-file

Configuration ( /etc/logrotate.d/log-file):

/var/log/log-file {
    monthly
    rotate 5
    compress
    delaycompress
    missingok
    notifempty
    create 644 root root
    postrotate
        /usr/bin/killall -HUP rsyslogd
    endscript
}

monthly : rotate each month (alternatives: daily, weekly, yearly).

rotate 5 : keep five archived logs.

compress : gzip the rotated logs.

delaycompress : skip compression for the most recent archive.

missingok : ignore missing log files.

notifempty : do not rotate empty logs.

create 644 root root : create a new log file with specified permissions.

postrotate/endscript : restart rsyslog after rotation.

Example 2 – Size Threshold

Rotate a log file when it reaches 50 MB, keeping five archives.

/var/log/log-file {
    size=50M
    rotate 5
    create 644 root root
    postrotate
        /usr/bin/killall -HUP rsyslogd
    endscript
}

Example 3 – Date‑Stamped Archives

Add dateext to include the creation date in archived filenames.

/var/log/log-file {
    monthly
    rotate 5
    dateext
    create 644 root root
    postrotate
        /usr/bin/killall -HUP rsyslogd
    endscript
}

Troubleshooting

1. Run Logrotate Manually

Execute logrotate for all configurations: # logrotate /etc/logrotate.conf Or for a specific file:

# logrotate /etc/logrotate.d/log-file

2. Dry‑Run

Use the -d option to simulate rotation without making changes:

# logrotate -d /etc/logrotate.d/log-file

3. Force Rotation

Force rotation even if conditions are not met, with verbose output:

# logrotate -vf /etc/logrotate.d/log-file

4. Logrotate’s Own Log

Logrotate writes its status to /var/lib/logrotate/status. You can specify an alternative status file with -s:

# logrotate -vf -s /var/log/logrotate-status /etc/logrotate.d/log-file

5. Cron Job

A daily cron job for logrotate is installed automatically. The typical script ( /etc/cron.daily/logrotate) cleans non‑existent entries from the status file and then runs logrotate:

#!/bin/sh
# Clean non‑existent log file entries from status file
cd /var/lib/logrotate
[ -e status ] || touch status
head -1 status > status.clean
sed 's/"//g' status | while read logfile date; do
    [ -e "$logfile" ] && echo "\"$logfile\" $date"
 done >> status.clean
mv status.clean status
[ -x /usr/sbin/logrotate ] || exit 0
/usr/sbin/logrotate /etc/logrotate.conf

Conclusion

Logrotate is an essential tool for preventing log files from exhausting disk space. Once configured, it runs automatically without human intervention. The examples above cover common use cases, and you can adapt the configuration to meet specific requirements.