logrotate

Wat het doet

Zo schrijf je het

logrotate [OPTION]... CONFIG_FILE...

Belangrijkste delen

daily, weekly, monthly, yearly

When to rotate.

size SIZE / minsize / maxsize

Rotate by size (like 100M).

rotate N

Keep N old files.

compress / delaycompress

gzip old files / wait one cycle.

dateext

Add the date to the name (RHEL default).

missingok / notifempty

No error if missing / skip empty logs.

create MODE OWNER GROUP

Make the new log with these rights.

copytruncate

Copy and empty the file (for programs that keep it open).

postrotate … endscript

Commands after the rotation, like a reload.

sharedscripts

Run the scripts once for all files of the rule.

maxage DAYS

Delete rotated files older than this.

su USER GROUP

Rotate as this user (for folders not owned by root).

Meest gebruikt

Niets past bij dit filter.

$ als gewone gebruiker# als root (of met sudo)

1. 1Show the main settings

   $grep -v '^#' /etc/logrotate.conf | grep .
   weekly
   rotate 4
   create
   dateext
   include /etc/logrotate.d

   Defaults for all rules.

2. 2Rules of a package

   $cat /etc/logrotate.d/httpd

   Includes a postrotate reload of httpd.

3. 3Write a rule for your app

   #cat /etc/logrotate.d/app
   /var/log/app.log {
       weekly
       rotate 8
       compress
       missingok
       notifempty
       create 0640 root root
   }

   Keeps 8 weeks of compressed logs.

4. 4Test a rule

   #logrotate -d /etc/logrotate.d/app

   Shows the plan; nothing changes.

5. 5Force a rotation now

   #logrotate -fv /etc/logrotate.d/app

   Check the result with ls -l /var/log/app.log*.

6. 6Rotate by size

   #cat /etc/logrotate.d/bigapp
   /var/log/bigapp/*.log {
       size 200M
       rotate 5
       compress
       copytruncate
   }

   For apps that cannot reopen their logs.

7. 7When did it run last?

   $systemctl list-timers logrotate.timer
   #cat /var/lib/logrotate/logrotate.status | head

   The state file stores the last rotation per log.

8. 8Keep logs for compliance

   #sed -i 's/^rotate 4/rotate 52/' /etc/logrotate.conf

   One year of weekly logs (check the disk space; also send logs to a central server).

9. 9Find rules with errors

   #logrotate -d /etc/logrotate.conf 2>&1 | grep -i error

   Wrong owners or rights stop the rotation.

10. 10Reload a service after rotation

    #grep -A3 postrotate /etc/logrotate.d/nginx

    Without it, the program writes to the renamed old file.

Niets past bij dit filter.

Bestanden

/etc/logrotate.conf

Main settings.

/etc/logrotate.d/

Rules per program.

/var/lib/logrotate/logrotate.status

Last rotation times.

Exitcodes