Practical Tips: Use Logrotate to manage system logs

Practical Tips: Use Logrotate to manage system logs-Linux Enterprise applications-Linux server applications. For details, refer to the following. For Linux system security, log files are extremely important tools. The system administrator can use the logrotate program to manage the latest events in the system.

For Linux system security, log files are extremely important tools.

The system administrator can use the logrotate program to manage the latest events in the system. Logrotate can also be used to back up log files. This article will introduce the following parts:

Log File Management:

1. logrotate Configuration

2. logrotate is configured by default.

3. Use the include option to read other configuration files

4. Use the include option to overwrite the default configuration

5. Configure dump parameters for the specified file


1. logrotate Configuration


The logrotate program is a log file management tool. It is used to delete the old log file and create a new log file. We call it a "dump ". We can dump the logs based on the log file size or the number of days. This process is generally executed by the cron program.

The logrotate program can also be used to compress log files and send logs to the specified email.


The logrotate configuration file is/etc/logrotate. conf. The main parameters are as follows:


Parameter Functions

Compress compresses logs after dumping through gzip

This parameter is used when nocompress does not require compression.

Copytruncate is used to back up and truncate the current log file that is still being opened.

Nocopytruncate backs up log files but does not truncate

Create mode owner group dump file, create a new log file using the specified file mode

Nocreate does not create a new Log File

When delaycompress and compress are used together, the dumped log files are compressed only when they are transferred to the next dump.

Nodelaycompress overwrites the delaycompress option, and the dump is compressed at the same time.

The error message sent to the specified Email address when the errors address exists

Ifempty dumps even empty files. This is the default logrotate option.

Notifempty is not dumped if it is an empty file

Mail address sends the dumped log file to the specified E-mail address

Do not send log files when nomail dump

The log file after the olddir directory is dumped is placed in the specified directory and must be in the same file system as the current log file.

The log file after noolddir dumping and the current log file are placed in the same directory

Prerotate/endscript can put this pair of commands that need to be executed before dumping. These two keywords must be in a separate line.

Postrotate/endscript can be placed into this pair of commands to be executed after the dump. These two keywords must be entered separately.

Daily indicates that the dump cycle is daily.

Weekly indicates that the dump cycle is weekly.

Monthly specifies the dump cycle as per month

Rotate count indicates the number of dump times before the log file is deleted. 0 indicates no backup, and 5 indicates five backups are retained.

Tabootext [+] list to prevent logrotate from dumping files with the specified extension. The default extension is. rpm-orig,. rpmsave, v, and ~

Size: dump a log file only when it reaches the specified Size. size can specify bytes (default), KB (sizek), or MB (sizem ).

2. logrotate is configured by default.

The default logrotate configuration directory/etc/logrotate. conf.

The default installation file content of Red Hat Linux is:


# See "man logrotate" for details

# Rotate log files weekly

Weekly

# Keep 4 weeks worth of backlogs

Rotate 4

# Send errors to root

Errors root

# Create new (empty) log files after rotating old ones

Create

# Uncomment this if you want your log files compressed

# Compress

1

# RPM packages drop log rotation information into this directory

Include/etc/logrotate. d

# No packages own lastlog or wtmp -- we'll rotate them here

/Var/log/wtmp {

Monthly

Create 0664 root utmp

Rotate 1

}

/Var/log/lastlog {

Monthly

Rotate 1

}

# System-specific logs may be configured here

The default configuration is generally placed at the beginning of the logrotate. conf file, affecting the entire system. In this example, the first 12 rows are displayed.

The third line weekly specifies that all log files are dumped once a week.

The fifth line rotate 4 specifies four copies of the dump file.

Row 7 errors root specifies the error message to be sent to the root user.

In the ninth line, create specifies that logrotate automatically creates a new log file. The new log file has

The original file has the same permissions.

Row 11th # compress specifies not to compress the dump file. If compression is required, remove the comment.

3. Use the include option to read other configuration files

The include option allows the system administrator to centralize the dump information distributed to several files

Main configuration file. When logrotate reads the include option from logrotate. conf, it reads the configuration information from the specified file, as if they are already in/etc/logrotate. conf.

Row 3: include/etc/logrotate. d. Tell logrotate to read data in/etc/logrotate. d directory. When the RPM package is installed in the system, the include option is very useful. The log dump parameters of the RPM package are generally stored in the/etc/logrotate. d directory.

The include option is very important. Some applications store the log dump parameter in/etc/logrotate. d.

Typical applications include apache, linuxconf, samba, cron, and syslog.

In this way, the system administrator only needs to manage a/etc/logrotate. conf file.

4. Use the include option to overwrite the default configuration

When/etc/logrotate. conf reads a file, the dump parameter in the file specified by include will overwrite the default parameter, as shown in the following example:

# Linuxconf Parameters

/Var/log/htmlaccess. log

{Errors jim

Notifempty

Nocompress
Weekly

Prerotate

/Usr/bin/chattr-a/var/log/htmlaccess. log

Endscript

Postrotate

/Usr/bin/chattr + a/var/log/htmlaccess. log

Endscript

}

/Var/log/netconf. log

{Nocompress

Monthly

}

In this example, when the/etc/logrotate. d/linuxconf file is read, the following parameters will overwrite the default parameters in/etc/logrotate. conf.

Notifempty

Errors jim

5. Configure dump parameters for the specified file

You often need to configure parameters for the specified file. A common example is to dump/var/log/wtmp every month. The parameter format used for a specific file is:

# Note

/Full/path/to/file

{

Option (s)

}

The following example is a monthly dump of/var/log/wtmp:

# Use logrotate to rotate wtmp

/Var/log/wtmp

{

Monthly

Rotate 1

}

Vi. Other issues needing attention

1. Although the beginning of the curly braces can be placed on the same line as other texts, the curly braces at the end must be arranged separately.

2. Use the prerotate and postrotate options

The following is a typical script/etc/logrotate. d/syslog.

/Var/log/messages is valid.

/Var/log/messages

{

Prerotate

/Usr/bin/chattr-a/var/log/messages

Endscript

Postrotate

/Usr/bin/kill-HUP syslogd

/Usr/bin/chattr + a/var/log/messages

Endscript

}

The first line specifies that the script is valid for/var/log messages

How can I read and read the apricot in mumalaria? /Var/log/messages

The prerotate command specifies the previous Dumping Action/usr/bin/chattr-a to remove the "only append" attribute of the/var/log/messages file. The endscript end the prerotate part of the script postrotate specifies action

/Usr/bin/killall-HUP syslogd

Used to reinitialize the system log daemon syslogd

/Usr/bin/chattr + a/var/log/messages

Specify the "APPEND only" attribute for the/var/log/messages file to prevent programmers or users from overwriting the file.

The final endscript is used to end the postrotate part.

3. logrotate is run in three steps:

Determine the System Log File, establish the dump plan and parameters, and run the following code through cron daemon: Red Hat Linux default crontab to run logrotate every day.

#/Etc/cron. daily/logrotate

#! /Bin/sh

/Usr/sbin/logrotate/etc/logrotate. conf

4./var/log/messages:

This is rare, but if you disable port 514/UDP in/etc/services, this file will not be generated.

Summary: This article introduces the typical logrotate configuration example on the Red Hat system, and details the application method of the logrotate program. We hope to help all Linux system administrators. Good Management and Analysis of log files are the first step in system security. In future articles, FreeLAMP will introduce another good logcheck for checking logs.