Master Logrotate: Stop Disk‑Full Crises with Automated Log Rotation

On Monday the author was pulled into a call because a shared filesystem had filled up; running df -h showed the root volume was full. After deleting a huge Liferay log (90 GB) and restarting Tomcat, the service came back up.

logrotate is designed to ease administration of systems that generate large numbers of log files. It allows automatic rotation, compression, removal, and mailing of log files. Each log file may be handled daily, weekly, monthly, or when it grows too large.

Normally, logrotate is run as a daily cron job. It will not modify a log more than once in one day unless the criterion for that log is based on the log's size and logrotate is being run more than once each day, or unless the -f or --force option is used.

The author examined the /etc/logrotate.conf file, which includes the line include /etc/logrotate.d. Sample configuration snippets are shown:

# rotate log files weekly
weekly
# keep 4 weeks worth of backlogs
rotate 4
create
# use date as a suffix of the rotated file
dateext
#uncomment to compress rotated logs
#compress
include /etc/logrotate.d

Specific rules for /var/log/wtmp and /var/log/btmp are demonstrated, using monthly, rotate 1, create 0664 root utmp, and minsize 1M.

Logrotate can also manage third‑party package logs via files in /etc/logrotate.d. The author installed httpd on a clean CentOS 7 system and inspected the generated /etc/logrotate.d/httpd file:

/var/log/httpd/*log {
    missingok
    notifempty
    sharedscripts
    delaycompress
    postrotate
        /bin/systemctl reload httpd.service > /dev/null 2>&1 || true
    endscript
}

Key parameters are explained:

missingok : ignore missing files.

notifempty : do not rotate empty logs.

sharedscripts : run postrotate script only once per group.

delaycompress : compress rotated logs on the next rotation.

postrotate/endscript : reload the service after rotation.

To handle rapid log growth, the author created a cron job that runs logrotate every minute:

* * * * * /usr/sbin/logrotate /etc/logrotate.d/httpd

A monitoring script monitorlog.sh continuously lists the sizes of /var/log/httpd files. By generating traffic to the Apache server, the author observed how logs are rotated, how new empty logs are created, and how the notifempty option prevents rotation of empty files.

When the postrotate script was commented out, the rotated logs were no longer written to, because Apache continued writing to the old file. Adding the copytruncate option solved this by copying the log and truncating the original, allowing the service to keep writing to the same file.

Using dateext adds a date suffix to rotated files (e.g., access_log-20200422). However, when combined with a per‑minute cron job, dateext prevented further rotations because the pattern no longer matched *log. The author introduced dateformat (e.g., -%Y%m%d%H.%s) to include both date and seconds, enabling multiple rotations per day.

Finally, a size‑based rotation was added ( size 50K) and compress was enabled. Logs exceeding 50 KB are rotated, renamed with the date‑time suffix, and compressed (e.g., access_log-2020042417.1587722341.gz), dramatically reducing disk usage.

The tutorial concludes with a reminder that logrotate is a powerful, built‑in tool for managing log growth and keeping production systems stable.