How to Setup and Manage Log Rotation Using Logrotate in Linux

Logs are very important when we have the trouble and it gives the detail of the error that allow us to solve the issue faster. Logs have information about the events for a service or for the whole server. On a server, there is the place that store all kinds of logs and separate it base on the service that run on the server, like the Web Server or MySQL, etc.

If we look at the contents of /var/log on a CentOS/RHEL/Fedora we will see the following log files and subdirectories.

$ ls /var/log/

These logs will keep on growing in size base on time that make us not only difficult to manage, but also eat our disk space on the system. It can grow to GB if we never check it. In order to manage the logs and keep them under check, we use logrotate utility of linux system.

What is Logrotate?

Logrotate provides an ability for system administrator to systematically rotate and archive any files that created by the service that run on the system and thus reducing a operating system’s disk space requirement. Be default logrotate is called once a day that is use cron scheduler from location /etc/cron.daily/. You will see it when you run command below:

$ sudo ls /etc/cron.daily/
logrotate  man-db.cron

Installation

Logrotation is installed by default on most Linux distributions. If it’s not installed by default, we can easily install by using the default package manager on the default repositories. For RHEL/CentOS use the following command:

$ yum install logrotate

Configuration logrotate

Logrotate’s configuration is done by editing file at /etc/logrotate.conf but we can also separately create our configuration for each service in the path /etc/logrotate.d/.

One thing that we need to make sure is that the main configuration must contains the following parameter:

$ sudo vim /etc/logrotate.conf

If it’s not yet include in this file, you can add “include /etc/logrotate.d” and save the file.

Including new service logs to logrotate

In this section we will rotate the logs for the website sharedhow.com that log is stored at /var/log/sharedhow.com/. We will create new logrotate configuration file at /etc/logrotate.d/ using commands below:

$ cd /etc/logrotate.d
$ vim sharedhow.com

Insert a following text into sharedhow.com:

 /var/log/sharedhow/*log {
    missingok
    rotate 50
    notifempty
    compress
    size 20k
    daildy
    create 0600 root root
}

Here is a line by line explanation of the above logrotate configuration file:

• missingok – do not output error if logfile is missing
• rotate 50 – indicates that only 3 rotated logs should be kept. Thus, the oldest file will be removed on the fourth subsequent run.
• notifempty – donot rotate log file if it is empty
• compress – Old versions of log files are compressed with gzip(1) by default
• size 20k – Log file is rotated only if it grow bigger than 20k
• daily – ensures daily rotation
• create – creates a new log file with permissions 600 where owner and group is root user

To be sure that logrotate is working fine without any issues, run the command below:

$ /usr/sbin/logrotate -d /etc/logrotate.d/sharedhow.com

Once the configuration has been checked and confirmed there’s no issues, we can also force run the script with the command below,

$ /usr/sbin/logrotate -f /etc/logrotate.d/sharedhow.com