Log Rotate Information

Log Rotate is a command utility used by UNIX/ Linux administrators to generate large numbers of log files. It can be set up to automatically perform rotation, compression, removal and mail log files to the right party. It also gives an option weather to handle log files daily, weekly, monthly or even by size. It runs in the background and perform tasks assigned by a System administrator. The Linux/UNIX system administrator, rather than deleting or truncating log files, they keep them for a while in case they need to refer to them. The Log rotate utility manages system log and other files automatically. This utility is controlled by /etc/logrotate.conf file; it set the default values and optionally specifies files to be rotated. It has an include statement that point to /etc/logrotate.d.

Installing Log Rotate

Log rotate can be created from scratch or copied from existing configs and modify appropriately.

~# emerge log rotate

Scheduling log rotate to be ran every day, a script called logrotate.cron inside /etc/logrotate.conf has to be executed.The log rotate directory configuration file can be located anywhere. In this inastance it is in /usr/sbin/logrotate.

#!/bin/sh
/usr/sbin/logrotate 
/etc/logrotate.conf

Options

-v Turns on verbose mode

-d Turns on debug mode. In debug mode, no changes will be made to the logs or to the log rotate state file.

-f, --force This command tells log rotate to force the rotation, even if it doesn't think this is necessary. Sometimes this is useful after adding new entries to log rotate, or if old log files has been removed by hand, as the new files will be created, and logging will continue correctly.

-m, --mail This command tells log rotate which command to use when mailing logs. This command should accept two arguments: 1) The subject of the message, and 2) The recipient. The command must then read a message on standard input and mail it to the recipient. The default mail command is /bin/mail -s.

-s, --state This command tells log rotate to use an alternate state file. This is useful if log rotate is being run as a different user for various sets of log files. The default state file is /var/lib/logrotate/status.

--usage Log rotate will print a short usage message.

Configuration file

Log rotate reads everything about the log files it should be handling from the series of configuration files specified on the command line. Each configuration file can set global options (local definitions override global ones, and later definitions override earlier ones) and specify a logfile to rotate.

Some of the information on the directives which may be included in a log rotate configuration file: Old versions of log files are compressed with gzip by default.

compresscmd Specifies which command to use to compress log files. The default is gzip.

uncompresscmd Specifies which command to use to uncompress log files. The default is gunzip.

compressext Specifies which extension to use on compressed logfiles, if compression is enabled.

compressoptions Command line options may be passed to the compression program, if one is in use.

copy Make a copy of the log file, but don't change the original file. Can be used to make a snapshot of the current log file, or when some other utility needs to truncate or pare the file.

copytruncate Truncate the original log file in place after creating a copy, instead of moving the old log file and optionally creating a new one. No effect, on the old log file.

daily Log files are rotated every day.

delaycompress Postpone compression of the previous log file to the next rotation cycle. This has only effect when used in combination with compress. It can be used when some program cannot be told to close its logfile and thus might continue writing to the previous log file for some time.

extension ext Log files are given the final extension ext after rotation. If compression is used, the compression extension (normally .gz) appears after ext.

ifempty Rotate the log file even if it is empty, overriding the notifempty option (ifempty is the default). When a log is rotated out-of-existence, it is mailed to address. If no mail should be generated by a particular log, the nomail directive may be used.

mailfirst When using the mail command, mail the just-rotated file, instead of the about-to-expire file.

maillast When using the mail command, mail the about-to-expire file, instead of the just-rotated file (this is the default).

missingok If the log file is missing, go on to the next one without issuing an error message. See also nomissingok. monthly Log files are rotated the first time logrotate is run in a month (this is normally on the first day of the month).

nocompress Old versions of log files are not compressed with gzip.

nocopy Do not copy the original log file and leave it in place. (this overrides the copy option).

nocopytruncate Do not truncate the original log file in place after creating a copy (this overrides the copytruncate option).

nocreate New log files are not created (this overrides the create option).

nodelaycompress Do not postpone compression of the previous log file to the next rotation cycle (this overrides the delaycompress option).

Functions/Use

Logrotate is run a cron job daily and does not modify a log a log multiple times a day, unless the –force option is used to override its normal function. If there is no argument given in the command line, logrotate will print a version of copy right information and a usage summary.

Examples

Some of the example provided by BALAKRISHNAN MARIYAPPAN, a Systems Engineer at bksystems, India.

'/etc/cron.daily/logrotate' – This shell script executes the logrotate command every day.The script will rotate the file named test in var/lo/test.logdaily and keep the last 4 logs rotated in the past. The attribute daily can be changed with weekly or monthly. In this example the file is also compressed.

$ cat /etc/logrotate.d/test
/var/log/test.log {
daily
rotate 4
compress
} 

/etc/logrotate.conf; Is the directory where all the log rotation configuration are specified.The number 4 following the rotate key is the number of rotated log files a user wants to keep. The create key causes the rotate to create a new log file with the new name and also the same attributes inherited from the rotated log file.

$cat /etc/logrotate.conf
weekly
rotate 4
create
include /etc/logrotate.d
/var/log/wtmp {
monthly 
minsize 1M
create 0664 root utmp 
rotate 1
}

When the file reaches 5KB, the log rotate utility will rotate the file. It will create a new file with same attributes as the rotated file, and retain only the 2 recent rotated logs.

$ cat logrotate.conf
/tmp/output.log {
        size 5k
        create 500 test 
        rotate 2
}

Log Rotate is a useful tool. It makes Linux or UNIX administrators work easier by executing one script that manages log files. With the different options on command line, log file can be rotated, compressed or emailed as desired. Most of the Linux/UNIX operating systems have log rotate already installed. Best practice is to navigate through system files and find the log rotate configuration file in /etc/logrotate.conf directory where the default file is located. And the /etc/logrotate.d is usually the default directory that is used by log rotate.

See also Information

• http://www.techrepublic.com/article/manage-linux-log-files-with-logrotate/1052474

References Information

• N. Wells. (2005). The Complete Guide to Linux System Administration.Boston, MA:Thomson Course Technology.
• M. G. Sobell. (2012).A Practical Guide to Fedora and Red Hat Enterprise Linux.Saddle River NJ. Pearson Education Inc.

External References

Category:Unix configuration utilities Category:Log file formats Category:Linux configuration utilities