The 1. page content

Introductory

If you run many services on our server, comprehensive and systematic scanning of our log files becomes difficult. The logrotate command that automatically rotates log files generated by various programs, compresses older ones, and deletes older ones than the specified time, as well as the ability to send email notifications. With the use of the program, we no longer have to worry about log files being buried after a few days or weeks of absence, because they are waiting in an orderly state for us to review them. In this description we will get acquainted with the general use of the Logrotate program.

Installation

A logrotate command is part of the Debian 8 (Jessie) and Debian 9 (Stretch) core systems, so it is immediately usable. If for some reason you are not in our system, install the logrotate package with the following command:

apt-get install logrotate

Currently, Debian 8 (Jessie) includes Logrotate 3.8.7 and Debian 9 (Stretch) 3.11.0. If you need a newer version, you need to download the source of the program at From GitHub, and then translate the fresh package as described there. But this is not needed in most cases, as there is plenty of distribution included.

operation

The logrotate command is executed from the system's timer, cron, which normally runs daily:

cat /etc/cron.daily/logrotate

#!/bin/sh

test -x /usr/sbin/logrotate || exit 0
/usr/sbin/logrotate /etc/logrotate.conf

Here, after verifying the existence of the binary script, run it, giving it the main configuration file (logrotate.conf), which contains some basic settings and a configuration for rotating a few system - wide log files (wtmp, btmp), as well as a directory that stores additional configurations in which programs that generate different log files can place their configuration files for rotation. The latter directory is important to us, as we also need to create the configuration files for the log files we want to rotate in this directory.

This directory is /etc/logrotate.d/. This contains the configuration files that the logrotate command uses to rotate that log file. Each option file here can be a separate log file option, or a single file can have multiple options. For example, if a service generates multiple log files in parallel, it is advisable to define them in a configuration file so that the structure remains transparent at a later stage.

Apache example settings

Let's see an example from the existing files, read it Apache configuration file is:

cat /etc/logrotate.d/apache2

In this we find the following (this example is in Debian 8 (Jessie) from LAMP Server highlighted):

/var/log/apache2/*.log {
        daily
        missingok
        rotate 14
        compress
        delaycompress
        notifempty
        create 640 root adm
        sharedscripts
        postrotate
                if /etc/init.d/apache2 status > /dev/null ; then \
                    /etc/init.d/apache2 reload > /dev/null; \
                fi;
        endscript
        prerotate
                if [ -d /etc/logrotate.d/httpd-prerotate ]; then \
                        run-parts /etc/logrotate.d/httpd-prerotate; \
                fi; \
        endscript
}

In this example, the first line specifies the log file (s). In the present case, / Var / log / apache2 The directory rotation settings for each file with the .log extension have the following meaning:

daily

Rotate log file daily. Here you can set other intervals: weekly, monthly, yearly

MISSING

If a log file that does not match the above pattern does not exist, the switch will not take it as an error, but will jump to the next one.

rotate x

Rotate x times. So with the above daily setting, you rotate the log files for 14 days, that is, increase the number of the previous ones and then rename the current one to serial number 1. Any file that has already reached the xth rotation will be deleted or emailed, if the mail directive is also specified. If you enter 0 here, no rotation will take place, but older versions will be deleted immediately.

compress

If specified, compresses older versions after rotation.

delaycompress

If this is specified (only the compress option), you postpone compression by one phase. So you do not immediately compress the rotated log file, but only in the next rotation cycle. This can come in handy when you need to read the previous log file immediately without having to uncompress it. For example, various web statistics may use the previous log file, etc.

notifempty

The switch will not rotate the log file if it is empty. It is useful for error logs, because if there is no error in a particular log file for a long time, the older ones will not be deleted.

create 640 root adm

Here you can control the permissions, user and group that logrotate creates the new blank log file when rotating. This can be useful if, for example, a daemon is sensitive to the permissions settings of your log files.

sharedscripts

If the configuration block applies to more log files (such as * .log) than in this example, and postrotate part is also specified, the logrotate program will run the script specified in the postrotate section by default when rotating each file. For example, in the case of Apache, when you run the access.log and error.log files, the script runs twice, reloading Apache. If this switch is present, it prevents the script from running multiple times on the same configuration block, so it runs only once after all specified files have been rotated.

postrotate

After rotating the log file (s), it runs the snippet of code between the "postrotate" and "endscript" tags. This allows you to execute useful commands after rotating the log files. In this example, reloading Apache (not restarting it!).

prerotate

This block of code (up to "endscript") is executed before the log files are rotated. In this example, you are checking to see if a exists /etc/logrotate.d/httpd-prerotate directory, if so, executes all executable files in it. Use for longer processes, such as keeping logs open so that they cannot be rotated until they are closed.

Further settings

In addition to the example settings above, there are other options, here are some more.

copytruncate

When you rotate a log file, instead of moving the file and creating a new file, it copies the original and then deletes its contents. So physically the same file remains after shooting. For example, it may be useful if you cannot close and reopen a log file that is open by a process.

size

The size parameter controls how long the logrotate program allows the log file to grow before rotating. Examples:

size 100k
size 100M
size 100G

This option has higher priority than daily / weekly / monthly / yearly option, so if the log file size exceeds the file size specified above, rotation will occur in the next cron cycle as the program runs.

dateext

As a result of the switch, the name of the saved log file is not numbered when rotated, but the current date is entered instead. This only works properly for a maximum of once a day rotation, because the next rotation will overwrite the daily file with the newer version that was created on the same day. So if there is a chance that a log file will be rotated more than once in a day, do not use it.

Example output filename:

naplo.log-20190412.gz

maxage

Deletes a log file older than the date specified for the switch, regardless of other settings. Example:

[...]
maxage 10
[...]

In this case, the rotation deletes instances of the log file older than 10 days.

compresscmd and compressext

The switches control what compression program logrotate uses and what extension to add to rotated and compressed log files. Example:

[...]
compresscmd /bin/bzip2
compressext .bz2
[...]

Of course, only the compress valid with switch.

mail

When rotating, the system sends the rotated log file to the specified email address. Example:

[...]
mail <email@hoszt.hu>
[...]

So these would be Logrotate's options for fine-tuning the process of rotating and archiving log files. THE next page we will continue to explore the program with our own useful examples.

Navigation