Creatation of logrotate entry in the server 10.0.5.

94

1. Create a file named autodb in /etc/logrotate.d/

2. The entries inside autodb

/opt/BACKUP/AUTO* {
daily
missingok
notifyempty
rotate 2
}

Some Examples of Logrotate

Managing log files effectively is an essential task for Linux sysadmin.

In this article, let us discuss how to perform following log file operations using UNIX logrotate
utility.

 Rotate the log file when file size reaches a specific size
 Continue to write the log information to the newly created file after rotating the old log file
 Compress the rotated log files
 Specify compression option for the rotated log files
 Rotate the old log files with the date in the filename
 Execute custom shell scripts immediately after log rotation
 Remove older rotated log files

1. Logrotate Configuration files

Following are the key files that you should be aware of for logrotate to work properly.

/usr/sbin/logrotate – The logrotate command itself.

/etc/cron.daily/logrotate – This shell script executes the logrotate command everyday.

$ cat /etc/cron.daily/logrotate
#!/bin/sh

/usr/sbin/logrotate /etc/logrotate.conf
EXITVALUE=$?
if [ $EXITVALUE != 0 ]; then
/usr/bin/logger -t logrotate "ALERT exited abnormally with [$EXITVALUE]"
fi
exit 0

/etc/logrotate.conf – Log rotation configuration for all the log files are specified in this file.

$ cat /etc/logrotate.conf
weekly
rotate 4
create
include /etc/logrotate.d
/var/log/wtmp {
monthly
minsize 1M
create 0664 root utmp
 rotate 1
}

/etc/logrotate.d – When individual packages are installed on the system, they drop the log rotation
configuration information in this directory. For example, yum log rotate configuration information
is shown below.

$ cat /etc/logrotate.d/yum
/var/log/yum.log {
missingok
notifempty
size 30k
yearly
create 0600 root root
}

2. Logrotate size option: Rotate the log file when file size reaches a specific limit

If you want to rotate a log file (for example, /tmp/output.log) for every 1KB, create the logrotate.-
conf as shown below.

$ cat logrotate.conf
/tmp/output.log {
size 1k
create 700 bala bala
rotate 4
}

This logrotate configuration has following three options:

 size 1k – logrotate runs only if the filesize is equal to (or greater than) this size.
 create – rotate the original file and create the new file with specified permission, user and
group.
 rotate – limits the number of log file rotation. So, this would keep only the recent 4 rotated
log files.

Before the logrotation, following is the size of the output.log:

$ ls -l /tmp/output.log
-rw-r--r-- 1 bala bala 25868 2010-06-09 21:19 /tmp/output.log

Now, run the logrotate command as shown below. Option -s specifies the filename to write the
logrotate status.

$ logrotate -s /var/log/logstatus logrotate.conf

Note : whenever you need of log rotation for some files, prepare the logrotate configuration and run
the logroate command manually.
After the logrotation, following is the size of the output.log:

$ ls -l /tmp/output*
-rw-r--r-- 1 bala bala 25868 2010-06-09 21:20 output.log.1
-rwx------ 1 bala bala 0 2010-06-09 21:20 output.log

Eventually this will keep following setup of rotated log files.

  output.log.4.
 output.log.3
 output.log.2
 output.log.1
 output.log

Please remember that after the log rotation, the log file corresponds to the service would still point
to rotated file (output.log.1) and keeps on writing in it. You can use the above method, if you want
to rotate the apache access_log or error_log every 5 MB.

Ideally, you should modify the /etc/logrotate.conf to specify the logrotate information for a specific
log file.

Also, if you are having huge log files, you can use: 10 Awesome Examples for Viewing Huge Log
Files in Unix

3. Logrotate copytruncate option: Continue to write the log information in the

newly created file after rotating the old log file.
$ cat logrotate.conf
/tmp/output.log {
size 1k
copytruncate
rotate 4
}

copytruncate instruct logrotate to creates the copy of the original file (i.e rotate the original log file)
and truncates the original file to zero byte size. This helps the respective service that belongs to that
log file can write to the proper file.

While manipulating log files, you might find the sed substitute, sed delete tips helpful.

4. Logrotate compress option: Compress the rotated log files

If you use the compress option as shown below, the rotated files will be compressed with gzip util-
ity.

$ cat logrotate.conf
/tmp/output.log {
size 1k
copytruncate
create 700 bala bala
rotate 4
compress
}

Output of compressed log file:

$ ls /tmp/output*
output.log.1.gz output.log

5. Logrotate dateext option: Rotate the old log file with date in the log filename
$ cat logrotate.conf
/tmp/output.log {
 size 1k
copytruncate
create 700 bala bala
dateext
rotate 4
compress
}

After the above configuration, you’ll notice the date in the rotated log file as shown below.

$ ls -lrt /tmp/output*
-rw-r--r-- 1 bala bala 8980 2010-06-09 22:10 output.log-20100609.gz
-rwxrwxrwx 1 bala bala 0 2010-06-09 22:11 output.log

This would work only once in a day. Because when it tries to rotate next time on the same day, ear-
lier rotated file will be having the same filename. So, the logrotate wont be successful after the first
run on the same day.

Typically you might use tail -f to view the output of the log file in realtime. You can even combine
multiple tail -f output and display it on single terminal.

6. Logrotate monthly, daily, weekly option: Rotate the log file weekly/daily/monthly

For doing the rotation monthly once,

$ cat logrotate.conf
/tmp/output.log {
monthly
copytruncate
rotate 4
compress
}

Add the weekly keyword as shown below for weekly log rotation.

$ cat logrotate.conf
/tmp/output.log {
weekly
copytruncate
rotate 4
compress
}

Add the daily keyword as shown below for every day log rotation. You can also rotate logs hourly.

$ cat logrotate.conf
/tmp/output.log {
daily
copytruncate
rotate 4
compress
}

7. Logrotate postrotate endscript option: Run custom shell scripts immediately af-
ter log rotation
Logrotate allows you to run your own custom shell scripts after it completes the log file rotation.
The following configuration indicates that it will execute myscript.sh after the logrotation.

$ cat logrotate.conf
/tmp/output.log {
size 1k
copytruncate
rotate 4
compress
postrotate
/home/bala/myscript.sh
endscript
}

8. Logrotate maxage option: Remove older rotated log files

Logrotate automatically removes the rotated files after a specific number of days. The following
example indicates that the rotated log files would be removed after 100 days.

$ cat logrotate.conf
/tmp/output.log {
size 1k
copytruncate
rotate 4
compress
maxage 100
}

9. Logrotate missingok option: Dont return error if the log file is missing

You can ignore the error message when the actual file is not available by using this option as shown
below.

$ cat logrotate.conf
/tmp/output.log {
size 1k
copytruncate
rotate 4
compress
missingok
}

10. Logrotate compresscmd and compressext option: Sspecify compression com-

mand for the log file rotation
$ cat logrotate.conf
/tmp/output.log {
size 1k
copytruncate
create
compress
compresscmd /bin/bzip2
compressext .bz2
rotate 4
}

Following compression options are specified above:

  compress – Indicates that compression should be done.
 compresscmd – Specify what type of compression command should be used. For
example: /bin/bzip2
 compressext – Specify the extension on the rotated log file. Without this option, the rotated
file would have the default extension as .gz. So, if you use bzip2 compressioncmd, specify
the extension as .bz2 as shown in the above example.

Implement logrotate config file

Once config file is ready just simply copy it into logrotate directory and change owner and permissions:
cp linuxserver /etc/logrotate.d/
chmod 644 /etc/logrotate.d/linuxserver
chown root.root /etc/logrotate.d/linuxserver

Finally, you can experiment with the log rotation (outside of the usual cron job) by forcing an execution of the
logrotate in the absence of any log files to rotate.
logrotate -f /etc/logrotate.d/linuxserver

Logrotate: The Most Basic Log Management Tool [Examples]

Logrotate is the default and easiest log management tool around. It is shipped by default with most
of the major Linux distributions. Logrotate can help you to rotate logs (in other words, it can create
a separate log file per day/week/month/year or on the basis of size of log file). It can compress the
older log files. It can run custom scripts after rotation. It can rename the log to reflect the date.

Logrotate scripts goes to /etc/logrotate.d/. Let us see some examples to understand it better. Here
we'll rotate /var/log/anyapp.log

1. Rotate logs daily:

$ cat /etc/logrotate.d/anyapp
/var/log/anyapp.log {
daily
rotate 7
}

The logrotate script above will rotate /var/log/anyapp.log everyday and it'll keep the last 7 rotated
log files. Instead of daily you can use monthly or weekly also.

2. Compress the rotated logs:

$ cat /etc/logrotate.d/anyapp
/var/log/anyapp.log {
daily
rotate 7
compress
}
Now you'll find that logrotate is also compressing the rotated files. This is really a big life saver if
you want to save some disk space which is a very common use case specially in VPS or cloud envi-
ronment.
By default logrotate does a gzip compression. You can alter this behavior by using compresscmd.
For example "compresscmd /bin/bzip2" will get you bzip2 compression.

3. Compress in the next cycle:

$ cat /etc/logrotate.d/anyapp
/var/log/anyapp.log {
daily
rotate 7
compress
delaycompress
}

This is useful in case it is not possible to immediately compress the file. This happens when the
process keeps on writing to the old file even after the rotation. If the last line sounded strange to you
then you might want to read about inodes. Also note that "delaycompress" will work only if "com-
press" is included in the script.

4. Compressing the copy of the log:

$ cat /etc/logrotate.d/anyapp
/var/log/anyapp.log {
daily
rotate 7
compress
delaycompress
copytruncate
}

Copytruncate comes handy in the situation where process writes to the inode of the log and rotating
the log might cause process to go defunct or stop logging or a bunch of other issues. Copytruncate
copies the log and the further processing is done on the copy. It also truncates the original file to
zero bytes. Therefore the inode of the file is unchanged and process keeps on writing to the log file
as if nothing has happened.

5. Don't rotate empty log and don't give error if there is no log:
$ cat /etc/logrotate.d/anyapp
/var/log/anyapp.log {
daily
rotate 7
compress
delaycompress
copytruncate
notifempty
missingok
}

Self explanatory. Both "notifempty" and "missingok" has opposite twins named "ifempty" and
"nomissingok" which are the defaults for logrotate.

6. Execute custom script before and/or after logrotation:

$ cat /etc/logrotate.d/anyapp
/var/log/anyapp.log {
daily
rotate 7
prerotate
/bin/myprescript.sh
endscript
postscript
/bin/mypostscript.sh
endscript
}

You can run multiple scripts/commands as long as they are in between (pre|post)rotate and end-
script. I have removed some of the parameters from the script to maintain readability.

I have just scratched the surface of logrotate. In practice it is capable of much more. You should
check out logrotate's man page for more options.