A simple guide on logrotate

This is tested on CentOS 6.5, where logrotate is native. Can be installed on Debian-based distros aswell with:

$ apt-get install logrotate

Introduction

Logrotate is a program to automate rotation, compression, and deletion of log-files. It is really useful in systems that generate lots of log-files, like most systems do these days. Each log file may be handled daily, weekly, monthly, and in our example weekly.

Your logrotation configuration files is located in /etc/logrotate.d/, usually with a file per application.

An useful example

Lets say we got problems with our httpd access logs, and that they over time actually have filled up our disk. We want to compress these and delete them over time, to avoid this in the future. In /etc/logrotate.d/ i will create a file called httpd, but you can call it whatever you want. Logrotate will scan all files in the logrotate.d-directory. In this file i will add the following lines:

/var/logs/httpd/*.log {
  copytruncate
  compress
  missingok
  weekly
  rotate 4
  maxage 30
}

Explained

First i write the path of where the httpd logs are located. In this case /var/logs/httpd/, followed by a * and a .log ending, telling logrotate to rotate all files in that directory (../httpd/), with a file ending called .log. Then i tell it to do a few things with these files:

With copytruncate i copy the log to an empty log. Then i truncate the original.
With compress i tell logrotate to compress the *.log files, one per file, everytime logrotate is running. The default is to compress with gzip.
With missingok i tell logrotate that it is ok if the file is missing. Then it will not complain about it, and just continue with the other files.
With weekly i tell logrotate to rotate my logs one time per week.
With "rotate 4" i tell logrotate to rotate my logs 4 times (to do the compression, to check up on various stuff, etc.) before deleting them.
With "maxage 30" i tell logrotate to delete any files older than 30 days.

So in this case all files ending on .log in /var/log/httpd/ will get compressed one time per week, and deleted after 4 weeks (rotate 4).

Rotate your logs already

If you actively want to rotate your logs, just run the following command:

# logrotate -vf /etc/logrotate.conf

The -v is for verbose information about what is going on, and the -f is for force, to force the rotation.

Logrotate testing

How to test your new logrotate configuration:

# logrotate -d /etc/logrotate.conf

The -d flag is for debugging mode. If you want make a combination of these, just use the -f flag as well for the force of rotation:

# logrotate -df /etc/logrotate.conf

A lot more to discover

Remember that there is a lot more options, and that logrotate is a really powerful and flexible tool. I would recommend you to take a look at logrotate's man-page, which is really descriptive:

# man logrotate