logrotate Cheat Sheet

logrotate Cheat Sheet

Get Social!

logrotate Most Linux applications create log files that need to be managed by either archiving or deleting old log files. This process is called log file rotation. The most common log rotation utility for Linux is conveniently called logrotate. logrotate is configured using the main configuration file, or the logrotate configuration folder. The configuration file usually holds the global configuration and the pointer to the configuration folder. In common Linux distributions such as Ubuntu and Debian, the logrotate configuration file can be found:

/etc/logrotate.conf

And the configuration folder can be found:

/etc/logrotate.d/

The configuration folder is usually where you would add new log file configurations which are unique for a particular log file, or set of log files. For example, if you were to add a new log rotation action for the Ubuntu package manager apt, you may use something like below:

vi /etc/logrotate.d/apt
/var/log/apt/term.log {
  rotate 12
  monthly
  compress
  missingok
  notifempty
}
/var/log/apt/history.log {
  rotate 12
  monthly
  compress
  missingok
  notifempty
}

logrotate runs each day by default, and is invoked using the daily cron job. The below subject detail the common components of creating a logrotate configuration file.

Create a new empty template

To create a new logrotate configuration file, you need to create a new file in /etc/logrotate.d/. You will then need to add a reference to the log files you wish to rotate. This can be directly to a single file or use pattern matching to match a group of log files. The below example matches all log files in /var/log/myapp/ which have a .log extension.

/var/log/myapp/*.log {

}

You will need to add further commands to this template before it becomes useful. Further commands will be added inside the and } tags.

Rotate based on log file size

Use the size keyword to rotate the log file when it exceeded a given file size. The below example rotates a file when it reaches 10 KB.

/var/log/myapp/*.log {
  size 10k
}

Rotate based on time (Month, Week or Day)

You can rotate logs using the monthlyweekly or daily keyword to create a new log based on duration. The keywords explain them selves, and they can be used in conjunction with the size keyword to rotate on which ever criteria is met first.

/var/log/myapp/*.log {
  size 10k
  weekly
}

Limit how many log files are kept after rotation by number

The rotate keyword allows you to specify how many old, rotated, log files are kept before logrotate deletes them. The rotate keyword requires an integer to specify how many old log files are kept.

/var/log/myapp/*.log {
  size 10k
  weekly
  rotate 8
}

The above example will keep 8 old log files.

Limit how many files are kept after rotation by date

You can specify how long to keep rotated files using the maxage keyword. Any rotated log files which are older than maxage will be deleted. The below example will keep rotated log files for 56 days.

/var/log/myapp/*.log {
  size 10k
  weekly
  maxage 56
}

Compress rotated log files

Log files which have been rotated can be compressed to save disk space. Gzip is used by default.

/var/log/myapp/*.log {
  size 10k
  weekly
  rotate 8
  compress
}

You can change the default gzip compression to another format by specifying the compresscmd command and a different executable to use. The below example changes the compression format to bzip2 for better file compression.

/var/log/myapp/*.log {
  size 10k
  weekly
  rotate 8
  compress
  compresscmd /bin/bzip2
}

Ignore missing log files

If a log file does not exist when logrotate is running then an error will be thrown. You can use the keyword missingok to avoid this scenario and instruct logrotate to ignore the log file if it does not exist.

/var/log/myapp/*.log {
  size 10k
  weekly
  rotate 8
  missingok
}

Continue writing to the same log file after rotation

Usually when a log file is rotated the log file is moved to a new location. Some applications may throw an error, and others may continue to write to the relocated file. The copytruncate keyword copies all the log in the file to a new file and then truncates the original file. This keeps the original log file in place and also allows rotation to continue.

/var/log/myapp/*.log {
  size 10k
  weekly
  rotate 8
  copytruncate
}

 

Let me know in the comments if you think anything is missing.


18 Comments

Roman Grazhdan

7-Feb-2014 at 6:35 am

Banning a whole country (maybe several countries, I guess China is banned too) from a site which appears on the third position of a google search. Nice move. :3

    james.coyle

    7-Feb-2014 at 10:48 am

    The web servers which serve jamescoyle.net do not implement any country based restrictions.

Chris

6-Mar-2015 at 4:10 pm

I appreciate the work you put forth in the site, makes it very clear how logrotate works and how it can be configured. Nice job.

Josh Loberant

11-May-2015 at 5:24 pm

Nice write-up! Clear and concise.

Mike Z

13-May-2015 at 12:58 pm

This is perfect. Thank you!

deoren

27-Aug-2015 at 4:21 pm

Thanks so much for posting this.

I used the ‘maxage’ setting to specify 365 (one year’s worth of files) in a logrotate conf file expecting the 4+ years of old logs to be rotated out once logrotate had a chance to process them. The next day all of those logs were rotated, but still present.

After turning to Google ,I ended up here and your “Limit how many files are kept after rotation by date” section made it completely obvious why I didn’t get the expected results. The ‘maxage’ setting ONLY applies to already rotated log files. Reading the man page again I see where I missed that, but thanks for using such an explicit section description.

    Krishna

    14-Jun-2019 at 12:54 pm

    this is a very useful reply. thanks man.
    and it is an awesome read. definitely going in my bookmarks

yorkbai

6-Apr-2016 at 6:53 am

I using copytruncate owner ascii txt log file , such as a.txt . but the file(a.txt) change to “data” type after logrotate . why ?

yorkbai

6-Apr-2016 at 6:56 am

it’s my conf file:
/tmp/req*.txt {
copytruncate
rotate 1440
missingok
dateext
dateformat .%s
olddir /tmp/source
nocompress
ifempty
}

Koustuv Paul

23-May-2016 at 9:20 am

First of all thank you for such a nice post. I have configured logrotate to rotate files on basis of some size. It is working fine except on problem. Few log lines are missed while rotating from one file to another. I could verify it by writing serial number to log files. The head of the current file does not sync with the tail of the last file. there is a difference of 4 -5 lines.
Is there anyway to capture all the logs without missing even a single line?

Thanks & Cheers!
Koustuv Paul

justin

3-Oct-2016 at 7:32 pm

hi, im trying to make a process where xyz.log is moved named xyz_daily.todaysdate.log then after a week of daily logs roll them up into a weekly log. named xyz.log_weekly.dateran.log and so on for a month and up to a year. i have been doing a lot of research and I’m still unable to figure out how to set this if anyone can give me some advice on how to make this work i would greatly appreciate your help.

Sudhir

21-Nov-2017 at 10:19 am

Hey,
This is awesome , Wanna love to read about moving the logs after rotation to remote server using scp command in pre/post rotate.

James

2-May-2018 at 10:23 pm

Thanks for this! It was clean and concise and easy to follow.

DavidR

13-Jul-2018 at 7:32 pm

What’s the best way to skip a particular log file?

Rosario Aranjuez

27-Aug-2018 at 1:10 pm

PLease help about my concern. I want compress rotating file to save space.

/appl/config/Lev1/Web/Logs/SASServer7_1/SASDecisionServices*log.2018*
{
missingok
nodateext
nocreate
daily
compress
delaycompress
sharedscripts
postrotate
/usr/bin/mv -f /appl/config/Lev1/Web/Logs/SASServer7_1/SASDecisionServices*log.2018* /data/RTDM_Logs/
endscript
}

Krishabh Chandak

3-Jun-2019 at 9:05 am

How to delete log files for last an hour

Gopi

4-Nov-2019 at 11:09 am

Clear and concise. Thanks for the write up.

Reno

17-Aug-2021 at 7:41 pm

Hello there,

I hve 10 log files, and I wish to delete from these, 4 files that reaches 3GB

What should I do in this case?

Thx

Leave a Reply

Visit our advertisers

Quick Poll

Do you use GlusterFS in your workplace?

Visit our advertisers