logrotate Command: Tutorial & Examples

Keeping Your Logs Organized

If you're running a Linux server or a virtual machine (VM) without a graphical user interface, chances are you rely heavily on logs to keep an eye on what's happening behind the scenes. Logs are essential for monitoring system activities, debugging issues, and analyzing performance. However, as your server runs continuously, these log files can grow rapidly, consuming valuable disk space. Enter logrotate – a lifesaver when it comes to managing log files on your Linux server.

logrotate is a powerful command-line utility that automates log file rotation, compression, and cleanup. It is designed to handle log files systematically, ensuring they don't eat up all your precious disk space and become difficult to manage.

How does logrotate work?

The basic idea behind logrotate is straightforward. It works by creating a configuration file, usually located at /etc/logrotate.conf, where you specify which log files to rotate, how often to rotate them, and what actions to perform during rotation.

The key parameters in the configuration file include:

• rotate: The number of log files to keep before overwriting the oldest one. For example, if you set rotate 5, it will keep the last five log files, and the sixth rotation will overwrite the oldest log.

• daily, weekly, or monthly: How often to rotate the log files. You can choose to rotate logs daily, weekly, or monthly based on your preferences.

• size: Rotate the log file when it reaches a certain size. For instance, size 10M will trigger rotation when the log file reaches 10 megabytes.

During rotation, logrotate renames the current log file, compresses it, and then creates a new empty log file for the application or service to continue writing logs into. The old log files can be compressed or simply renamed with a .1, .2, and so on, based on the number of rotations specified in the configuration.

Why is logrotate important?

Without proper log file management, you might encounter a few challenges:

• Disk Space Overflow: Large log files can fill up your disk space quickly, leading to application failures or even system crashes.

• Hard-to-Read Logs: A single massive log file can be challenging to navigate and find relevant information.

• Performance Impact: Continuously writing logs to an oversized file can slow down your server's performance.

By implementing logrotate, you keep your log files organized, save disk space, and ensure easy access to relevant information, making it a vital tool for server maintenance.

How to use logrotate?

Example 1: Basic Configuration

To get started, let's create a simple configuration for rotating a log file named /var/log/myapp.log, keeping five old logs, and rotating the logs daily:

# Create or edit the logrotate configuration file
sudo nano /etc/logrotate.d/myapp

# Add the following content
/var/log/myapp.log {
    rotate 5
    daily
}

Example 2: Compressing Rotated Logs

To compress the rotated log files, you can add the compress option in the configuration:

/var/log/myapp.log {
    rotate 5
    daily
    compress
}

Example 3: Specifying Log Size

If you want to rotate the logs based on their size, you can set the size parameter:

/var/log/myapp.log {
    rotate 5
    size 10M
}

Example 4: Postrotate Script

Sometimes you might need to perform additional actions after log rotation. You can specify a script to execute using the postrotate directive:

/var/log/myapp.log {
    rotate 5
    daily
    postrotate
        /usr/bin/some_script.sh
    endscript
}

Conclusion

logrotate is a powerful and essential tool for managing log files on your Linux server or VM. By automating log rotation and compression, it ensures your log files are kept in check, avoiding disk space overflow and maintaining a well-organized system. With the ability to customize rotation frequency and other options, logrotate empowers you to take charge of your server logs effortlessly.