1.About Log rotate
The logrotate program is a log file manager. It is used to regularly cycle (or rotate) log files by removing the oldest ones from your system and creating new log files. It may be used to rotate based on the age of the file or the file’s size, and usually runs automatically through the cron utility. .
- It is installed by default on Linux
- Runs as daily cron job and the cron script located in /etc/cron.daily directory
- Configuration file is /etc/logrotate.conf
- While installing RPM’s, the applications put log rotation configuration in /etc/logrotate.d/ for its specific application logs. Log rotate daemon scans this directory for specific configuration files for specific application/service logs rotation method
- Configurations under /etc/logrotate.d/ will override the options specified in /etc/logrotate.conf
- Pre rotate and Post rotate scripts can be used
- The logrotate program may also be used to compress log files and to configure e-mail to users when they are rotated
2. Setting up log rotate
To set rotate options for /var/log/messages and whatever the files which need rotation, edit /var/logrotate.d/syslog. This file contains the configuration for all the logs which controlled by syslog daemon.
Or create new file with the following syntax
Verify the default options in /etc/logrotate.conf and comment them if required.
Here is the sample configuration file for rotating /var/log/messages and other log files based on size
/var/log/warn /var/log/messages /var/log/allmessages /var/log/localmessages /var/log/firewall
create 640 root root
In the above configuration, when the logrotate daemon executed as cron job, it will look for the file to rotate (/var/log/messages and other files) and size of that file (10M) specified in configuration file /var/logrotate.d/syslog
If the specified size reached, it will execute the prerotate script which does an incremental backup of that log file and rotates it.
3. Options which can be used in configuration file.
In the prerotate section we can specify any script which we would like to run before the log rotation and we also have postrotate option as well.
We can use the logrotate, to control the size of the various application log files (messages, audit.log, etc...) By creating a configuration file under /etc/logrotate.d/
It will be helpful in controlling the growth of file system