Logrotation

Linux log rotation

Controlling the sizes of log files on a Linux server is crucial due to their continuous growth. As log files accumulate, they can consume valuable storage space, server resources, and cause performance issues. To address this problem, log rotation is commonly employed in most Linux distributions.

$ logrotate --version
logrotate 3.19.0

    Default mail command:       /usr/bin/mail
    Default compress command:   /bin/gzip
    Default uncompress command: /bin/gunzip
    Default compress extension: .gz
    Default state file path:    /var/lib/logrotate/status
    ACL support:                yes
    SELinux support:            yes

Main configuration

The main Logrotate configuration

$cat /etc/logrotate.conf
# see "man logrotate" for details

# global options do not affect preceding include directives

# rotate log files weekly, the frequency of log rotation. Alternatively, you can specify another time interval (hourly, daily, monthly, or yearly).
weekly

# use the adm group by default, since this is the owning group
# of /var/log/syslog.
su root adm

# keep 4 weeks worth of backlogs
# log files are rotated four times before old ones are removed. 
# If rotate is set to zero, then the old versions are removed immediately and not rotated. 
# If it is set to -1, the older logs will not be remove at all except if affected by maxage.
rotate 4

# create new (empty) log files after rotating old ones
create

# use date as a suffix of the rotated file
#dateext

# uncomment this if you want your log files compressed
#compress

# packages drop log rotation information into this directory
include /etc/logrotate.d

# system-specific logs may also be configured here.

Additional configuration

$ ls -al ls /etc/logrotate.d/
...
-rw-r--r--   1 root root   120 Sep  6  2019 alternatives
-rw-r--r--   1 root root   126 Dec  5  2019 apport
-rw-r--r--   1 root root   173 Apr  9  2020 apt
-rw-r--r--   1 root root    91 Apr  1  2020 bootlog
-rw-r--r--   1 root root   130 Jan 21  2019 btmp
-rw-r--r--   1 root root   209 Sep 19  2021 ufw
-rw-r--r--   1 root root   145 Feb 19  2018 wtmp
...

System dependent custom configuration

Create system dependent log rotation config file mylog under /etc/logrotate.d

$cat /etc/logrotate.d/mylog 
/var/log/mylog/*.log
{
    daily
    missingok
    rotate 7
    compress
    notifempty
}

test the new configuration
$sudo logrotate /etc/logrotate.conf --debug --verbose

test that the log rotation works without waiting for the specified schedule
$sudo logrotate -f /etc/logrotate.d/mylog
$ls /var/log/mylog/


verify if a particular log file is rotating or not
$sudo cat /var/lib/logrotate/status | grep mylog

Modifying access permissions

with create directive, we can change newly created log files will be owned by the <user> <group>

/etc/logrotate.d/mylog

/var/log/mylog.log
{
    ...
    create 644 <user> <group>
    ...
}

System independent custom configuration

create your configuration file outside of /etc/logrotate.d/

$cat ~/mylog/logrotate.conf
/home/<user>/mylog/*.log
{
    hourly
    missingok
    rotate 7
    compress
    notifempty
}

create a custom Logrotate state file 
$logrotate ~/mylog/logrotate.conf --state ~/mylog/logrotate.state

create cron jobs by adding At the bottom of the file
$crontab -e

0 * * * * /usr/sbin/logrotate /home/<user>/logify/logrotate.conf --state /home/<user>/logify/logrotate.state

Running commands or scripts before or after log rotation

prerotate directives - executes commands or scripts before log rotation
postrotate directives - executes commands or scripts after log rotation. 
Both directives are closed using the endscript directive

/home/<user>/mylog/*.log
{
    hourly
    missingok
    rotate 7
    compress
    notifempty
    sharedscripts
    prerotate
      do-pre-something 
    endscript 
    postrotate
      do-after-something
    endscript

}

Changing the system Logrotate schedule

Ubuntu logrotate schedule can be found at following path

$ ls -ald /etc/cron.*
drwxr-xr-x 2 root root 4096 Feb 25 13:20 /etc/cron.d
drwxr-xr-x 2 root root 4096 Feb 25 13:23 /etc/cron.daily
drwxr-xr-x 2 root root 4096 Feb 25 13:20 /etc/cron.hourly
drwxr-xr-x 2 root root 4096 Feb 25 13:20 /etc/cron.monthly
drwxr-xr-x 2 root root 4096 Feb 25 13:21 /etc/cron.weekly

regardless of schedule in above configuration file, we can move configuration file from one to the other cron.xxx path
$ sudo mv /etc/cron.daily/logrotate /etc/cron.hourly