In Linux, most services and programs are running in the background, such as Apache, Nginx, Postfix and other recorded information about its status, performance and errors in log files. The default location for logs or as they are called logs – /var/log.
Using log analysis you can understand what’s wrong, why the error occurred and how to solve the problem. But the lies one problem. Logs size is constantly growing and they occupy more and more disk space, so you need time to clean logs and delete obsolete entries, so they do not interfere with normal work. This can be done manually from time to time, or configure the Cron scripts, but there is a more simple variant – utility logrotate. In this paper we consider a setup logrotate and its use.
How does Logrotate?
Logrotate utility is designed to automate log processing. It may carry with them the necessary actions depending on certain conditions and compliance rules. For example, you can compress logs into the archive or send to another server when they reach a certain size, age, or other parameters.
The test conditions can be set daily, weekly or monthly. This allows you to create a schema for logs rotation, convenient for you and your server. Also logs rotation can be useful on a home computer, but here it is not as important as on servers only in the Apache logs can be written to hundreds of thousands of rows daily.
Logrotate is a popular utility, so in most distributions it comes by default. You can be sure that the program is installed in your distribution, try to install it. For example, in CentOS:
sudo yum install logrotate
Or in Ubuntu and derivative distros:
sudo apt install logrotate
Now, even if it is not installed, you will install it. All major program settings are in /etc/logrotate.conf for more settings, with regards to rules and other features can be placed in the folder /etc/logroate.d/. You can place all settings logroatae directly in the main configuration file, it will be more correct if the settings for each individual service will be in a separate file in the folder /etc/logrotate.d/.
To configuration files in this directory were loaded, you need to add in the main configuration file this line:
Just make sure that it is already there. First, let’s consider the basic guidelines, which we will use during configuration. Here the Directive does not look quite usual, the Directive itself defines what and when you want to do, and if necessary, it passes the additional parameters. To specify how often you want to test coincidence conditions are such directives:
- hourly every hour;
- daily – every day;
- weekly – every week;
- monthly – each month;
- yearly – every year.
Basic guidelines for managing and processing log:
- rotate – specifies how many old log-files to be stored in the parameters passed to the number;
- create – specifies that you must create an empty log file after moving the old;
- dateext – appends the date of the rotation before heading to the old log;
- compress – specifies that the log should be compressed;
- delaycompress – do not compress the last log;
- extension – keep the original log file after rotation if it has the specified extension;
- mail – send Email after completion of the rotation;
- maxage is to perform a log roll, if they are older than the specified number;
- missingok – do not issue errors if the log file does not exist;
- olddir – move old logs to a separate folder.
- postrotate/endscript – to execute arbitrary commands after rotation;
- start – the number that will start the numbering of old logs;
- size – the size of the log, when it will be moved;
Those are the basic guidelines that we will use. In the main configuration file is the global configuration directives that will apply to all logs if not canceled their action. Every log that rotates is described thus:
Now let’s create a file of rsyslog.conf in the folder /etc/logrotate.d/ and place the configuration for the rotation of this log:
This setting means that the log rotation occurs every day, and we will retain three latest log, older copies will automatically be deleted. The minimum size for the rotation is 10 MB, the rotation will not be executed if the log does not take more than 10 megabytes. You will use compression for all logs except the last and penultimate. Exactly the same principle you can configure log rotation for any of the magazines. We need to create a section for each of the logs that you want to manage.
It now remains to test how our configuration. It will run logrotate with the-d option. She will bring out all that is planned, but will not modify the files on the disk. We have the file /var/log/messages with a size of 40 Megabytes, will be doing utility:
logrotate -d /etc/logrotate.d/rsyslog.conf
As you can see, the program detects the log file and splits it into several parts. You can make sure that logrotate will run as expected after checking the schedule of cron:
Configure Logrotate completed and you stayed just to paint as you’ll run the log rotation for each log, which occupy a lot of space.
In this article, we considered how do you configure logrotate centos or any other Linux distribution. Utility is not much different depending on the distributions. If you have a server with a heavy load, you need to configure log rotation. I hope this information was useful for you. At the end of the video, how is log rotation in Ubuntu from the Linux professional Institute certification:
And another thing in English: