Rotating Log Files

Logging is good, but if your system writes too many log files, this can become problematic; log files that are not controlled may fill up your server's file system completely. As a solution, you can configure the logrotate service. The logrotate service runs as a daily cron job and checks its configuration files to see whether any rotation has to occur. In these configuration files, you can configure when a new log file should be opened and, if that happens, what exactly should happen to the old log file—should it, for example, be compressed or just deleted, and if it is compressed, how many versions of the old file should be kept?

The logrotate service works with two different kinds of configuration files. The main configuration file is /etc/logrotate.conf. In this file, generic settings are defined to tune how logrotate should do its work. You can see the contents of this file in Listing 12-3.

Listing 12-3. Contents of the logrotate.conf Configuration File

# see "man logrotate" for details

# rotate log files weekly weekly

# keep 4 weeks worth of backlogs rotate 4

# create new (empty) log files after rotating old ones create

# uncomment this if you want your log files compressed #compress

# uncomment these to switch compression to bzip2 compresscmd /usr/bin/bzip2

uncompresscmd /usr/bin/bunzip2

# former versions had to have the compresscommand set accordingly #compressext .bz2

# RPM packages drop log rotation information into this directory include /etc/logrotate.d

# no packages own wtmp -- we'll rotate them here #/var/log/wtmp {

# monthly

# create 0664 root utmp

# rotate 1

# system-specific logs may be also be configured here.

Listing 12-3 uses some important keywords. Table 12-1 defines them.

Table 12-1. Logrotate Options

Option

Description weekly This option specifies that the log files should be created on a weekly basis. If nothing is specified, the old file is removed.

rotate 4 This option makes sure that four old versions of the file are saved. If the rotate option is not used, old files are deleted.

create The old file is saved under a new name, and a new file is created. Typically, the old file will be renamed to the same filename with the date on which it was compressed appended to it, and a new file will open.

compress Use this option to make sure the old log files are compressed.

compresscmd This option specifies the command that should be used for creating the compressed log files.

uncompresscmd Use this command to specify what command to use to uncompress compressed log files.

include This important option makes sure the content of the directory /etc/logrotate.d is included. In this directory, files exist that specify how to handle some individual log files.

As you have seen, the logrotate.conf configuration file includes some generic code to specify how log files should be handled. In addition to that, most log files have a specific logrotate configuration file in /etc/logrotate.d. Figure 12-6 shows the content of this directory.

Re Edit View Terninai Tabs Help

laksmi

: /etc/logrotate.c

# Is -1

total

84

-rw-r-

-r—

1

root

root

1097

May

9

IB

32

apache2

-rw-r-

-r—

1

root

root

140

May

9

15

04

Eetchmail

-rw—r—

-r—

1

root

root

72

May

9

IS

29

heartbeat

-rw-r-

-r—

1

root

root

42

May

9

16

29

ldirectord

-rw—r—

-r—

1

root

root

1056

May

8

20

33

mysql

-rw-r-

-r—

1

root

root

229

May

S

15

31

net-snmp

-rw-r-

-r—

1

root

root

187

May

S

21

IB

ntp

-rw-r-

-r—

1

root

root

225

May

8

21

16

open sip-server

-rw-r-

-r—

1

root

root

1031

May

9

15

51

quagga

-rw-r-

-r—

1

root

root

141

May

9

14

43

rsync

-rw-r-

-r—

1

root

root

289

Apr

23

13

39

samba

-rw-r-

-r—

1

root

root

148

Apr

23

13

39

samba-winbind

-rw-r-

-r—

1

root

root

129

May

9

14

31

scpm

-rw-r-

-r—

1

root

root

642

May

9

15

26

squid

-rw-r-

-r—

1

root

root

1113

May

8

20

13

syslog

-rw-r-

-r—

1

root

root

551

May

8

20

30

syslog-ng

-rw-r-

-r—

1

root

root

134

May

8

20

08

wtmp

-rw-r-

-r—

1

root

root

140

May

9

13

15

xdm

-rw-r-

-r—

1

root

root

149

May

10

07

27

xend

-rw-r-

-r—

1

root

root

200

May

8

20

IB

xinetd

-rw-r-

-r—

1

root

root

144

May

11

12

04

zmd-backen-d

laksmi

: /etc/logrotate. c

#

Figure 12-6. In the directory/etc/logrotate.d, lots of files have their own logrotate configuration files.

The content of the service-specific configuration files in /etc/logrotate.d is in general more specific than the contents of the generic logrotate.conf. In Listing 12-4, you can see what the configuration script for /var/log/ntp looks like.

Listing 12-4. Example of the logrotate Configuration for NTP

/var/log/ntp { compress dateext maxage 365 rotate 99 size=+2048k notifempty missingok copytruncate postrotate chmod 644 /var/log/ntp endscript

Listing 12-4 uses some more options. Table 12-2 gives an overview of these options and their meanings.

Table 12-2. Options in Service-Specific logrotate Files

Option

Description

dateext

Appends the date the file is rotated to the old name of the log files.

maxage

Specifies the number of days after which old log files should be removed.

rotate

Specifies the number of times a log file should be rotated before being removed

or mailed to the address specified in the mail directive. After rotating the file, the

old one is removed.

size

Rotates files that grow bigger than the size specified here.

notifempty

Does not rotate the log file when it is empty.

missingok

If the log file does not exist, go on to the next one without issuing an error

message.

copytruncate

Truncates the old log file in place after creating a copy, instead of moving the old

file and creating a new one. This is useful for services that cannot be told to close

their log files.

postrotate

Use this option to specify some commands that should be executed after

performing the logrotate on the file.

endscript

Denotes the end of the configuration file.

Like the example for the NTP log file in Listing 12-4, all other log files can have their own logrotate file. You can even create logrotate files for files that are not log files at all! Some more options are available when creating such a logrotate file; for a complete overview, check the man pages.

Was this article helpful?

0 0

Post a comment