How do I rotate log files?

Q. How do I rotate log files under Linux operating system?

ADVERTISEMENTS

A. You need use tool called logrotate, which is designed to ease administration of systems that generate large numbers of log files. It allows automatic rotation, compression, removal, and mailing of log files.

Each log file may be handled daily, weekly, monthly, or when it grows too large. With this tool you keep logs longer with less disk space.

Default configuration file

The default configuration file is /etc/logrotate.conf:
# see "man logrotate" for details
# rotate log files weekly
weekly
# keep 4 weeks worth of backlogs
rotate 4
# create new (empty) log files after rotating old ones
create
# uncomment this if you want your log files compressed
#compress
# RPM packages drop log rotation information into this directory
include /etc/logrotate.d
# no packages own wtmp -- we'll rotate them here
/var/log/wtmp {
monthly
create 0664 root utmp
rotate 1
}
Service or server specific configurations stored in /etc/logrotate.d directory, for example here is sample apache logrotate configuration file:# cat /etc/logrotate.d/httpdOutput:

/var/log/httpd/*.log {
 weekly
 rotate 52
 compress
  missingok
  notifempty
  sharedscripts
  postrotate
      /bin/kill -HUP `cat /var/run/httpd.pid 2>/dev/null` 2> /dev/null || true    endscript
}

Where,

  • weekly : Log files are rotated if the current weekday is less then the weekday of the last rotation or if more then a week has passed since the last rotation.
  • rotate 52 : Log files are rotated 52 times before being removed or mailed to the address specified in a mail directive. If count is 0, old versions are removed rather then rotated.
  • compress : Old versions of log files are compressed with gzip to save disk space.
  • missingok : If the log file is missing, go on to the next one without issuing an error message.
  • notifempty : Do not rotate the log if it is empty
  • sharedscripts : Normally, prerotate and postrotate scripts are run for each log which is rotated, meaning that a single script may be run multiple times for log file entries which match multiple files. If sharedscript is specified, the scripts are only run once, no matter how many logs match the wildcarded pattern. However, if none of the logs in the pattern require rotating, the scripts will not be run at all.
  • postrotate
    /bin/kill -HUP `cat /var/run/httpd.pid 2>/dev/null` 2> /dev/null || true
    endscript : The lines between postrotate and endscript (both of which must appear on lines by themselves) are executed after the log file is rotated. These directives may only appear inside a log file definition.

See complete working example: How to rotating logs with logrotate for Lighttpd web server.

🐧 Get the latest tutorials on SysAdmin, Linux/Unix, Open Source/DevOps topics:
CategoryList of Unix and Linux commands
File Managementcat
FirewallAlpine Awall CentOS 8 OpenSUSE RHEL 8 Ubuntu 16.04 Ubuntu 18.04 Ubuntu 20.04
Network Utilitiesdig host ip nmap
OpenVPNCentOS 7 CentOS 8 Debian 10 Debian 8/9 Ubuntu 18.04 Ubuntu 20.04
Package Managerapk apt
Processes Managementbg chroot cron disown fg jobs killall kill pidof pstree pwdx time
Searchinggrep whereis which
User Informationgroups id lastcomm last lid/libuser-lid logname members users whoami who w
WireGuard VPNAlpine CentOS 8 Debian 10 Firewall Ubuntu 20.04

ADVERTISEMENTS
16 comments… add one
  • Ela Oct 1, 2009 @ 14:58

    Am getting this problem very biggly

    Please help me out

    vi /etc/logrotate.conf
    # see “man logrotate” for details
    # rotate log files weekly
    weekly

    # keep 4 weeks worth of backlogs
    rotate 4

    # create new (empty) log files after rotating old ones
    create

    # uncomment this if you want your log files compressed
    #compress

    # RPM packages drop log rotation information into this directory
    include /etc/logrotate.d

    # no packages own wtmp — we’ll rotate them here
    /var/log/wtmp {
    monthly
    minsize 1M
    create 0664 root utmp
    rotate 1
    }

    cat /etc/logrotate.d/httpd

    /var/log/httpd/*log {
    missingok
    notifempty
    sharedscripts
    postrotate
    /sbin/service httpd reload > /dev/null 2>/dev/null || true
    endscript
    }

    My server is running nearly 10 sites and all those creating log files under statistics in vhosts.
    it wil become more than 30 gb with in week. how to control it. please reply me

    • Anonymous Jun 29, 2010 @ 17:33

      @Ela
      Its always a good idea to rotate logs according to size instead of age when the logs are too big or too small. Rotating logs according to age favours for moderate logs only.

  • A Mukherjee Nov 9, 2009 @ 3:48

    Have you tried to install and run BleachBit?

  • Yogesh Jul 20, 2010 @ 5:22

    Try rotatelogs feature of httpd.conf :-)
    http://httpd.apache.org/docs/2.0/programs/rotatelogs.html

  • felipe1982 Oct 26, 2011 @ 4:50

    If I use

      sharedscripts
      postrotate
        do_something
       endscript
    

    Isn’t this 100% the same as doing

      firstaction
        do_something
      endscript
    
  • felipe1982 Oct 26, 2011 @ 5:01

    sorry! Change

    postrotate

    to

    prerotate
  • Suresh Soudherpally Jul 19, 2012 @ 0:03

    To rotate the httpd logs.

    /var/log/httpd/*log {
    missingok
    noolddir
    nomail
    copytruncate
    notifempty
    rotate 1
    size 1M
    }

    • Mike Nov 19, 2012 @ 17:44

      Where do you write this code?

      • Yogesh Nov 20, 2012 @ 3:06

        Create a new file under logrotate.d directory:
        /etc/logrotate.d/httpd

  • Maryam Sep 30, 2012 @ 6:33

    Dear friends,
    how can use this tool? it is downloadable tool??
    i need it but i can not find any thing, is it a feature in linux of a tool which can download it?
    would you please help me,
    it’s very helpful to me ,
    please

    • Anji Oct 29, 2012 @ 7:16

      Logrotate tool by default is included in the OS package itself, no need to download.

  • Raju Oct 30, 2012 @ 13:58

    Hi all,

    Can u please send me a configuration script to logrotate for below requirement

    Log rotate and compression
    Create archive of data older than 45 days and share it to rajcse09@gmail.com and delete It from existing log dir

    Thanks and Regards,
    Raju

  • Chiqo Feb 13, 2014 @ 10:30

    Hello,

    I have an issue. I want to rotate log using compression. The thing is the filename:

    /path/sessionId{blabla}

    So I tried /path/* but doing that, every gz archive is compressed again into .gz.gz

    Any idea?

  • lingtalfi Oct 28, 2014 @ 6:09

    Very informative thank you

  • Sajan Feb 19, 2016 @ 4:39

    Try running >> /usr/sbin/logrotate -d /etc/logrotate.conf

    See the httpd section in the result and how many rotations are mentioned there. Is it 4 or 52?

  • suraj Mar 2, 2016 @ 4:44

    Is there a way to rotate this log files to a centralised server, like SYSLOG .

Leave a Reply

Your email address will not be published.

Use HTML <pre>...</pre>, <code>...</code> and <kbd>...</kbd> for code samples.