Logrotate

Logrotate is a utility that rotates logs. Log rotation simply means to rename an existing log file to something else, thereby keeping the log file sizes tenable. Logrotate makes it easy to define log rotation rules, such as how many old logs to keep and for how long, the size a log should be before it's rotated, any post-rotation commands it needs to run, and more.

Introduction

Logrotate is typically found in your distro's repos as 'logrotate'.

# yum -y install logrotate

Logrotate is triggered daily via a cronjob installed in /etc/cron.daily/ and as a result, there is no logrotate daemon.

By default, installing Logrotate will also include some standard configuration files that will rotate some common system logs in /var/log.

Configuration

Configuration is done with /etc/logrotate.conf and additional log rotate definitions can be placed in /etc/logrotate.d/. For example, we could put httpd log rotation rules in /etc/logrotate.d/httpd.

Log rotations are defined with the following syntax:

/path/to/logs/*.log {
 ** Directives **
}

It should also have at minimum the following directives:

What	Directives
When to rotate. By time or by size.	daily, weekly, monthly OR size based: size 10M
How many rotated logs to keep. Eg. keep 30 logs. Anything past this will be deleted. Set this to 0 to delete all rotated logs.	rotate 30

You may also optionally add the following directives depending on your needs:

Whether to create a new empty log	create, nocreate
Use date as the suffix for rotated logs using the specified date format. Creates logs like 'messages-2020-12-26'	dateext dateformat .%Y-%m-%d
If you are not using date extensions, logrotate will use numbers starting at 0 instead. Specify the starting number. Eg. 1. The first rotated log would be 'messages.0'.	start 1
Whether to compress the log or not. Uses gzip by default.	compress
The extension of rotated log files. Eg. 'messages-2020-12-26.log' or 'messages.0.log'.	extension log
Send an email when a log is rotated out of existance.	mail user@domain.com
Ignore if file is missing	missingok
Don't rotate if the file is empty	notifempty
Run a command after the rotation is executed. The contents are run using /bin/sh. The log files are passed as an argument.	postrotate /bin/kill -HUP endscript

Tasks

Rotating Traefik logs

/var/log/traefik/*.log {
  daily
  rotate 30
  missingok
  notifempty
  compress
  dateext
  dateformat .%Y-%m-%d
  create 0644 root root

  size 10M
  rotate 50
  missingok
  notifempty
  postrotate
    docker kill --signal="USR1" $(docker ps | grep traefik | awk '{print $1}')
  endscript
}

Rotating syslog

# cat /etc/logrotate.d/syslog
/var/log/messages /var/log/secure /var/log/maillog /var/log/spooler /var/log/boot.log /var/log/cron {
    sharedscripts
    postrotate
        /bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null

Old

Without log rotation, log files such as /var/log/messages can continue to grow into many gigabytes. Reading such a large file might become tricky and it's a good idea to set up log rotation so that a new file is used after it has grown to a certain size.

In order to have logrotate rotate the logs weekly, ensure your configuration is similar to:

# cat /etc/logrotate.d/syslog
/var/log/messages /var/log/secure /var/log/maillog /var/log/spooler /var/log/boot.log /var/log/cron {
    # Run the pre/post rotate commands only once for all the logs
    # that are being rotated.
    sharedscripts
 
    # rotate weekly
    weekly
 
    # keep 2 years of logs
    rotate 104
 
    # send HUP to syslogd
    postrotate
        /bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null

You may also want to do other things such as email notifications or compression, which is available as well. Refer to RedHat's Deployment Guide for more information.

You may also want to have logrotate run automatically via cronjobs.

# crontab -l
@daily /usr/sbin/logrotate /etc/logrotate.conf > /dev/null 2>&1