Linux log File Explorer--logrotate

Log files contain useful information about the events that occur in the system, which are often used during troubleshooting or during system performance analysis. For busy servers, the log file size grows extremely fast and the server consumes disk space quickly, which is a problem. In addition, dealing with a single large log file is often tricky.

Logrotate is a useful tool that automatically truncates (or rounds) logs, compresses, and deletes old log files. For example, you can set Logrotate to have/var/log/foo log files every 30 days and delete logs for more than 6 months. Once configured, the logrotate is fully automated, without any further human intervention. In addition, old logs can be emailed, but this option is beyond the scope of this tutorial.

Logrotate packages are installed by default on mainstream Linux distributions, and if for some reason logrotate does not appear, you can install them using the Apt-get or Yum command.

On Debian or Ubuntu:

Apt-get Install logrotate cron

On Fedora,centos or Rhel:

Yum Install logrotate Crontabs

The configuration file for Logrotate is/etc/logrotate.conf, and it is usually not necessary to modify it. The rotation of the log file is set in a separate configuration file, which is placed in the/etc/logrotate.d/directory.

Sample One
In the first example, we will create a 10MB log file,/var/log/log-file. We'll show you how to manage the log file using Logrotate.

Let's start by creating a log file, and then fill in a 10MB of random bitstream data.

Touch/var/log/log-filehead-c 10M </dev/urandom >/var/log/log-file

Since the log file is now ready, we will configure Logrotate to round the log file. Let's create a configuration file for the file.

Vim/etc/logrotate.d/log-file

/var/log/log-file {
Monthly
Rotate 5
Compress
Delaycompress
Missingok
Notifempty
Create 644 root root
Postrotate
/usr/bin/killall-hup RSYSLOGD
Endscript
}
Over here:

Monthly: The log file will be round by month. Other available values are ' daily ', ' weekly ' or ' yearly '.
Rotate 5:5 archive logs will be stored at a time. For a sixth archive, the oldest archive will be deleted.
Compress: After a round-robin task is completed, the archived archive will be compressed using gzip.
Delaycompress: Always with the Compress option, the Delaycompress option indicates that logrotate does not compress the most recent archive, and compression will take place during the next round-robin cycle. This is useful when you or any software still needs to read the latest archive.
Missingok: During log rotation, any errors will be ignored, such as "files cannot be found".
Notifempty: If the log file is empty, the round robin does not proceed.
Create 644 root root: Creates a completely new log file with the specified permissions, and logrotate renames the original log file.
Postrotate/endscript: After all other instructions have been completed, the commands specified inside postrotate and Endscript will be executed. In this case, the RSYSLOGD process will immediately read its configuration again and continue to run.
The template above is generic, and the configuration parameters are adjusted according to your needs, not all parameters are necessary.

Example Two
In this case, we only want to round a log file, but the log file size can grow to 50MB.

Vim/etc/logrotate.d/log-file

/var/log/log-file {
size=50m
Rotate 5
Create 644 root root
Postrotate
/usr/bin/killall-hup RSYSLOGD
Endscript
}
Example Three
We want to have the old log file named after the creation date, which can be achieved by adding Dateext Changshu.

Vim/etc/logrotate.d/log-file

/var/log/log-file {
Monthly
Rotate 5
Dateext
Create 644 root root
Postrotate
/usr/bin/killall-hup RSYSLOGD
Endscript
}
This will allow the archive to include date information in their file names.

Troubleshooting
Here are some troubleshooting tips for logrotate settings.

1. Run Logrotate manually
   Logrotate can be called manually from the command line at any time.

To invoke Logrotate for all logs configured under/etc/lograte.d/:

Logrotate/etc/logrotate.conf

To call logrotate for a specific configuration:

Logrotate/etc/logrotate.d/log-file

1. Drill
   The best choice during the troubleshooting process is to run logrotate using the '-d ' option in a preview fashion. To validate, you can simulate the walkthrough log rotation and display its output without actually tracking any log files.

Logrotate-d/etc/logrotate.d/log-file

As we can see from the above output, logrotate it is not necessary to judge the round-robin. This can happen if the file is less than one day long.

1. Forced round robin
   Even if the round-robin condition is not met, we can force the Logrotate round log file by using the '-f ' option, and the '-V ' parameter provides verbose output.

Logrotate-vf/etc/logrotate.d/log-file

Reading config File/etc/logrotate.d/log-file
Reading Config info for/var/log/log-file

Handling 1 logs

Rotating pattern:/var/log/log-file forced from command line (5 rotations)
Empty log files is rotated, old logs is removed
Considering Log/var/log/log-file
Log needs rotating
Rotating Log/var/log/log-file, Log->rotatecount is 5
Dateext suffix '-20140916 '
Glob pattern '-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9] '
Renaming/var/log/log-file.5.gz to/var/log/log-file.6.gz (rotatecount 5, Logstart 1, I 5),
Old log/var/log/log-file.5.gz does not exist
Renaming/var/log/log-file.4.gz to/var/log/log-file.5.gz (rotatecount 5, Logstart 1, I 4),
Old log/var/log/log-file.4.gz does not exist
. . .
Renaming/var/log/log-file.0.gz to/var/log/log-file.1.gz (rotatecount 5, Logstart 1, I 0),
Old log/var/log/log-file.0.gz does not exist
Log/var/log/log-file.6.gz doesn ' t exist--won ' t try to dispose of it
Renaming/var/log/log-file to/var/log/log-file.1
Creating new/var/log/log-file mode = 0644 UID = 0 gid = 0
Running Postrotate Script
Compressing log with:/bin/gzip

1. Logging of Logrotate
   Logrotate's own logs are usually stored in the/var/lib/logrotate/status directory. If you are in a logrotate, we want to log to any specified file, and we can specify it from the command line as follows.

Logrotate-vf–s/var/log/logrotate-status/etc/logrotate.d/log-file

1. Logrotate Scheduled Tasks
   Logrotate required cron task should be automatically created at the time of installation, I put the contents of the cron file, for your reference.

Cat/etc/cron.daily/logrotate!/bin/shclean Non existent log file entries from status file

Cd/var/lib/logrotate
TEST-E Status | | Touch status
Head-1 Status > Status.clean
Sed ' s/'//g ' status | While read logfile date
Do
[-E "$logfile"] && echo "\" $logfile \ "$date"
Done >> Status.clean
MV Status.clean Status

Test-x/usr/sbin/logrotate | | Exit 0
/usr/sbin/logrotate/etc/logrotate.conf

To summarize, the Logrotate tool is useful for preventing large log files from exhausting storage space. After the configuration is complete, the process is fully automated and can be run for a long time without the need for human intervention. This tutorial focuses on several basic examples of using logrotate, and you can customize it to suit your needs.

Linux log File Explorer--logrotate