Quick Learning — Linux logrotate Command

In my previous blogs I have discussed managing disk space alerts, how to analyze the disk space usage, find and delete/archive the old logs and files, attaching additional disks and mounting those. A DevOps Engineer’s day-to-day activities include Monitoring and Housekeeping of Server’s filesystem is one of the major activity.

Is there a way to automate these housekeeping jobs? Reduce the disk space related alerts noise?
Yes, definitely there are ways to automate these tasks and enjoy your vacations without PagerDuty calls. In this blog, I explain about one of such automation using Linux server’s inbuilt utility logrotate, let’s get started.

What is a Log Rotation?

When we run applications / services on a server, they create some sort of log files and these are useful and needed for various purposes like, security audit, analytics, debugging, application health checkup, etc.

But almost every application creates one or many log files and these logs grow in size and also, grow in number of files, so they consume disk space.

Our job is to manage these log files, like compress, delete, archive etc. If we need to do that manually, certainly that is a tidies job, also what if you are managing 100’s or 1000s of servers, then that can’t be a manual job.

Luckily, Linux has an inbuilt utility called logrotate, it does all the work for us. It can delete, compress, rotate the log files automatically based on your requirements.

How Logrotate does its job

Here is the logrotate man page snippet, and it is a detailed manual, which explains each option including examples.

In this blog, I explain a bit about it with a few examples. As I’m trying to focus this one as a quick guide, I won’t be able to explain each option. I will plan to write a detailed blog on logrotate in the future.

Basically, logrotate is a Linux system command, and all the configuration is inside /etc/logrotate.conf file and the additional config files are stored inside the directory /etc/logrotate.d. Even though logroate does log files rotation, daily it's triggered by crond service.

crond is a Linux system daemon responsible for running the jobs at scheduled intervals. If you would like to know more about crond check man cron manual page.

This gets triggered as a daily job, and if you notice this file, it’s a simple shell script which executes the logrotate command.

And here is the conf file snippet.

If you notice the above config file, the line include /etc/logrotate.d, loads all the conf files available inside the directory /etc/logrotate.d

Get Sampath Inturi’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

You can also execute it manually by simply running the command /usr/sbin/logrotate /etc/logrotate.conf

Logrotate Configuration

Before creating your own logrotate configuration, here I explain the sample config options.

From the above sample config, the first 13 lines are the log file paths for which rotation is needed. Here you can provide log file names with regex patterns as well, for example, /var/log/*.log applies to all the log files with the name suffix .log

Then, inside curly braces, the log rotation options are specified, here is the explanation for each.

1. rotate 4 — This line tells, to keep the last 4 rotated log files, like if it’s weekly rotation, it keeps the last 4 weeks of files. For daily rotation, it keeps the last 4 days of log files.
2. weekly — Means the rotation happens weekly once. It supports options like, hourly, daily, weekly, monthly, etc.
3. missingok — This means, during the rotation, it won’t give an error even if the source file not available
4. notifempty — Don’t rotate the file if it’s an empty file.
5. compress — The log files get compressed after the rotation, this saves the disk space.
6. delaycompress — Postpone compression of the previous log file to the next rotation cycle. This only has an effect when used with compress.
7. size 10M — Log files are rotated only if they grow bigger than size bytes.

postrotate

/usr/lib/rsyslog/rsyslog-rotate

endscript

Here, the script or command /usr/lib/rsyslog/rsyslog-rotate gets executed after the log rotation. This is helpful when you want to execute any scripts after / before rotation, like stop/start a service.

And there are many other options available, those all are you can find from logrotate man page.