Cancel

Setup and Manage Log Rotation in Linux

Log files are the most valuable feature available in the Linux family. The Logrotate tool helps you to administrate, backup, and monitor log files in Linux.

Any service installed on your Linux systems such as nginx web server, or etc, generates log files that are usually stored in the /var/log directory.

The log files increase in size and take more disk space. If you are not careful, you can easily run out of disk space.

What is log rotation?

Logrotate is the tool which helps you to setup log rotation feature for different applications based on log size and other parameters. It can also compress the logs based on certain parameters, and can also be used to delete old log files. Set of parameters can be added in /etc/logrotate.conf file but for certain application logs, you can also used .conf file separately under /etc/logrotate.d path.

You need to use apt install logrotate -y command to install logrotate package.

1
2
3
4
apt install logrotate -y

logrotate --version
logrotate 3.14.0

After the usual log file rotation, your log files might look like the following.

1
2
3
4
5
6
# ls /var/log
...
nginx
nginx.1
nginx.2.gz
...

Let’s take an example of nginx server log rotate file /etc/logrotate.d/nginx where we have set the log rotation schedule with few important parameters as shown below.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
# cat /etc/logrotate.d/nginx
/var/log/nginx.log {
  # rotate log files every day, monthly, or, weekly.
  daily
  # count log files at least 3 times before being removed or mailed to the address specified in a mail directive.
  rotate 3
  # rotate log files only if they are larger then 5M size, or start taking backup when it reaches to 5 Megabytes.
  size 5M
  # If the log file is missing, go on to the next one without issuing an error message.
  missingok
  # Do not rotate the log if it's empty (this overrides the ifempty option).
  notifempty
  # this option runs the scripts only once.
  sharedscripts
  # Postpone compression of the previous log file to the next rotation cycle.
  delaycompress
  # Creates a new log file as soon as log rotation is completed with octal file permissions of 644 with user and group ownership of root.
  create 644 root root
  # When the number of logs finally reaches 6, the oldest log will be mailed to as mentioned below.
  mail yafiz@deletify.app
}

You can even test the log rotation feature for nginx logs using logrotate -d /etc/logrotate.d/nginx command as shown below. So, -d turns on debug mode and implies -v.

1
2
3
4
5
6
7
8
9
10
11
12
13
# logrotate -d /etc/logrotate.d/nginx
reading config file /etc/logrotate.d/nginx
Allocating hash table for state file, size 15360 B

Handling 1 logs

rotating pattern: /var/log/nginx/*log 5242880 bytes (3 rotations)
empty log files are not rotated, old logs are removed
considering log /var/log/nginx/access_log
log does not need rotating (log size is below the 'size' threshold)
considering log /var/log/nginx/error_log
log does not need rotating (log size is below the 'size' threshold)
not running postrotate script, since no logs were rotated

Conclusion

As you have read, how the logrotate tool can help you to manage the log files on your system and also understand some parameters of logrotate for configuration.

It will automatically rotate, compress, remove, and mail logs on a set of important parameters.

If You set logrotate as a cron job, and then it will make things much easier for you.