Methods of using Logrotate to manage log files in Linux systems

The log file contains useful information about the events that occur in the system, and is often used during the course of the troubleshooting or during the performance analysis. For busy servers, the log file size grows extremely fast and the server consumes disk space quickly, which is a problem. In addition, handling a single large log file is often tricky.

Logrotate is a useful tool that automatically truncates logs (or rounds), compresses them, and deletes old log files. For example, you can set up logrotate, let/var/log/foo log files every 30 days, and delete logs for more than 6 months. Once configured, the logrotate is fully automated, without any further human intervention. In addition, the old log can also be emailed, but this option is beyond the scope of this tutorial.

Logrotate packages are installed by default on mainstream Linux distributions, and if for some reason logrotate does not appear inside, you can install them using Apt-get or Yum commands.

On Debian or Ubuntu:

The code is as follows:

# apt-get Install logrotate cron

On the Fedora,centos or Rhel:

The code is as follows:

# yum Install logrotate Crontabs

The logrotate configuration file is/etc/logrotate.conf and does not normally need to be modified. The rotation of the log file is set in a separate configuration file, which is placed in the/etc/logrotate.d/directory.

Sample One

In the first sample, we will create a 10MB log file/var/log/log-file. We'll show you how to use logrotate to manage this log file.

Let's start by creating a log file, and then fill in a 10MB of random bit stream data.

The code is as follows:

# Touch/var/log/log-file

# head-c 10M </dev/urandom >/var/log/log-file

Since the log file is now ready, we will configure Logrotate to cycle through the log file. Let's create a configuration file for this file.

The code is as follows:

# Vim/etc/logrotate.d/log-file

/var/log/log-file {

Monthly

Rotate 5

Compress

Delaycompress

Missingok

Notifempty

Create 644 root root

Postrotate

/usr/bin/killall-hup RSYSLOGD

Endscript

}

Over here:

Monthly: Log files will be followed by a monthly rotation. Other available values are ' daily ', ' weekly ' or ' yearly '.

Rotate 5:5 archived logs will be stored at a time. For the sixth archive, the oldest archive will be deleted.

Compress: After the round-robin task is completed, the round-robin archive will be compressed using gzip.

Delaycompress: Always with the Compress option, the delaycompress option instructs Logrotate not to compress the most recent archive, and the compression will be done in the next round cycle. This is useful when you or any software still needs to read the latest archive.

Missingok: Any errors will be ignored during log rounds, such as "files cannot be found."

Notifempty: If the log file is empty, the round robin will not proceed.

Create 644 root root: Creates a completely new log file with the specified permissions, and logrotate renames the original log file.

Postrotate/endscript: After all other instructions have been completed, the commands specified in Postrotate and Endscript will be executed. In this case, the RSYSLOGD process will immediately read its configuration again and continue to run.

The template above is generic, and the configuration parameters are adjusted according to your requirements, not all parameters are necessary.

Sample Two

In this case, we just want to cycle through one log file, but the log file size can grow to 50MB.

The code is as follows:

# Vim/etc/logrotate.d/log-file

/var/log/log-file {

size=50m

Rotate 5

Create 644 root root

Postrotate

/usr/bin/killall-hup RSYSLOGD

Endscript

}

Sample Three

We want to have the old log file named after the creation date, which can be implemented by adding Dateext Changshu.

The code is as follows:

# Vim/etc/logrotate.d/log-file

/var/log/log-file {

Monthly

Rotate 5

Dateext

Create 644 root root

Postrotate

/usr/bin/killall-hup RSYSLOGD

Endscript

}

This will allow the archive file to include date information in their file names.

Obstacle-Arranging

Here are some tips for troubleshooting logrotate settings.

1. Manual Operation Logrotate

Logrotate can be invoked manually from the command line at any time.

To invoke Logrotate for all logs configured under/etc/lograte.d/:

The code is as follows:

# logrotate/etc/logrotate.conf

To invoke Logrotate for a particular configuration:

The code is as follows:

# Logrotate/etc/logrotate.d/log-file

2. Walkthrough

The best option in the troubleshooting process is to use the '-d ' option to run logrotate in a preview mode. To verify, you can simulate the walkthrough log and display its output without actually having to cycle through any log files.

The code is as follows:

# logrotate-d/etc/logrotate.d/log-file

As we can see from the output above, it is not necessary for logrotate to judge the cycle. This can happen if the file is less than one day in time.

3. Mandatory round-robin

Even if the round-robin conditions are not met, we can also force the Logrotate round log file by using the '-f ' option, and the '-V ' parameter provides verbose output.

The code is as follows:

# Logrotate-vf/etc/logrotate.d/log-file

Reading config File/etc/logrotate.d/log-file

Reading Config info for/var/log/log-file

Handling 1 logs

Rotating pattern:/var/log/log-file forced from command line (5 rotations)

Empty log files are rotated, old logs are removed

Considering Log/var/log/log-file

Log needs rotating

Rotating Log/var/log/log-file, Log->rotatecount is 5

Dateext suffix '-20140916 '

Glob pattern '-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9] '

Renaming/var/log/log-file.5.gz to/var/log/log-file.6.gz (rotatecount 5, Logstart 1, I 5),

Old log/var/log/log-file.5.gz does not exist

Renaming/var/log/log-file.4.gz to/var/log/log-file.5.gz (rotatecount 5, Logstart 1, I 4),

Old log/var/log/log-file.4.gz does not exist

. . .

Renaming/var/log/log-file.0.gz to/var/log/log-file.1.gz (rotatecount 5, Logstart 1, I 0),

Old log/var/log/log-file.0.gz does not exist

Log/var/log/log-file.6.gz doesn ' t exist--won ' t try to dispose of it

Renaming/var/log/log-file to/var/log/log-file.1

Creating new/var/log/log-file mode = 0644 UID = 0 gid = 0

Running Postrotate Script

Compressing log with:/bin/gzip

4. Logrotate Record Log

Logrotate's own logs are usually stored in the/var/lib/logrotate/status directory. If you are in a logrotate, we want to log to any specified file, we can specify this from the command line as follows.

The code is as follows:

# Logrotate-vf–s/var/log/logrotate-status/etc/logrotate.d/log-file

5. Logrotate Timing Task

Logrotate required cron tasks should be created automatically at the time of installation, I posted the contents of the cron file for your reference.

The code is as follows:

# cat/etc/cron.daily/logrotate

#!/bin/sh

# clean Non existent log file entries from status file

Cd/var/lib/logrotate

TEST-E Status | | Touch status

Head-1 Status > Status.clean

Sed ' s/'//g ' status | While read logfile date

Todo

[-E "$logfile] && echo" "$logfile $date"

Done >> Status.clean

MV Status.clean Status

Test-x/usr/sbin/logrotate | | Exit 0

/usr/sbin/logrotate/etc/logrotate.conf

To summarize, the Logrotate tool is useful for preventing storage space from being depleted by a large log file. After the configuration is complete, the process is fully automatic and can be operated for a long time without the need of human intervention. This tutorial focuses on several basic examples of using logrotate, and you can tailor it to meet your needs.

I hope this article will be of some help to you.