Logrotate

Logs are really handy when troubleshooting or simply trying to monitor usage of an application the downside to keeping logs is that they will consume all the storage space on your server if not kept in check and if left to run for to long you can end up with files so large you can’t open them in conventional text editors (I have seen users with log files of 30-40GB+),to prevent stupidly large log files or logs with data that is no longer relevant use logrotate.

Managing  logrotate

The main logrotate config file is located at /etc/logrotate.conf.

The logrotate.conf file contains the defaults for rotating logs. For application specific config files look in  /etc/logrotate.d This is where you will also add your custom config files.

As an example, lets have a look at the config file for Apache on CentOS .

/var/log/httpd/*log {
    missingok
    notifempty
    sharedscripts
    delaycompress
    postrotate
        /sbin/service httpd reload > /dev/null 2>/dev/null || true
    endscript
}

When run, logrotate checks for any files in /var/log/httpd that end in log e.g. error.log and rotates them, after rotating the logs the postrotate section is run, in this case reload apache then ends the script.

Log Files

Log files are rotated on what is set in the config file after you have specified the paths, to the logs, most application will only require one path but you can specify many paths separated by a space for example.

/var/logs/apache/vhosts/*.log /var/www/vhosts/*/logs/log.txt {
    rotate 7
    daily
    compress
    delaycompress
    sharedscripts
    postrotate
        /usr/sbin/apachectl graceful > /dev/null
    Endscript
}

Rotate Count

The rotate command sets how many archived log files are to be saved e.g.

rotate 7

This command tells logrotate to keep 7 log files after that the oldest logfile is removed so it maintains a maximum of 7 log fles.

Rotation Frequency

You can tell logrotate the frequency to rotate logs the values include:

daily weekly monthly yearly

If a rotation interval is not set the log will be rotated when logrotate runs (unless another condition like size has been set).

Log File Size

The sizecommand is used to set the file size for logrotate to check when performing a rotation, if the file is larger that the specified size the the log is rotated .e.g.

size 100k size 50M *size 1G

The size command takes priority over and the rotation frequency if both are set.

Compression

To archived log files in gzip format you can add the compress command

*compress

Compression is good as this can save you a lot of storage space as logs normally compress very well, If you don’t want to compress log file then you will need to add the nocompress command.

*nocompress

Another command of note in regard to compression is as follows:

*delaycompress

This is useful if you want to compress the logs, but want to delay the compression. When delaycompressis set, the log is compressed the next time that the log is rotated.

Postrotate

The postrotate script is run each time it rotates a log specified in a configuration block. You usually want to use this script to restart an application after the log rotation so that the app can switch to a new log.

postrotate
    /sbin/service httpd reload > /dev/null 2>/dev/null 
endscript

>/dev/null tells logrotate to pipe the command’s output to nowhere as we don’t need to see the output if there are no errors.

The postrotate and endscript command tells logrotate that the script to run,is bewtween these lines.

Sharedscripts

Logrotate runs the postrotate script every time it rotates a log. This is the same for multiple logs that use the same config block.

For example, a web server with multiple sites with with their own log files logrotate would restart apache for every log it has rotated which could mean hundreds of restarts to negate this you can use the sharedscripts command

*sharedscripts

By using the sharedscripts command this tells logrotate to check all the logs for that configuration block before running the postrotate script. If any of the logs are rotated then the postrotare script runs once.