You can get the advice from IT HELP DESK

SYSTEM[LINUX] What is logrotate?

15 Jan 2019
<head>Disk Management, Server Monitoring, System management, server monitoring, server management, system management, system monitoring, </head>

[LINUX] What is logrotate?

 1. Definition of logroate

It manages all the log files in the Linux system, and periodically compresses, backs up, deletes and sends mail by specifying the date of the log file.

In other words, it backs up the log file at a fixed time to prevent the log file from growing too much. When you specify the maximum number of log files, the rotating tool deletes the oldest log file if the maximum number is exceeded.

2. Necessity of logrotate

Server capacity is limited. If a lot of logs are piled up every day, the capacity becomes full and the performance drops. Manually deleting each time reduces the efficiency of your business, so you can use effective functions to manage your logs.

3. The Drive sequence of logrotate

Run logrotate using corn (set to allow periodic repetitions to run automatically).

crontab > cron.daily > logrotate > logrotate.conf > logrotate.d

① Call /usr/sbin/logrotate from cron.daily.

② /usr/sbin/logrotate refers to /etc/logrotate.conf configuration file.

③ Refer to /etc/logrotate.d (include /etc/logrotate.d) in the /etc/logrotate.conf configuration file.

4. How to use logrotate

  4.1 Verifying the Installation

# rpm –qf /etc/logrotate.conf

# rpm –qa | grep logrotate

logrotate has installed default on Linux. If it is not installed, install it by following the command below.

#sudo yum install –y logrotate

  4.2 Configuration Files


① weekly

Sets period to cycle. The default value is weekly.

yearly: every year, monthly: monthly, weekly: weekly, daily: daily

② rotate 4

Sets Number of files to be rotated. The minimum value is 0.

In the weekly setting above, if rotate 4 is given, it means that it is stored for 4 weeks and then circulated.

If you set rotate 20 for daily setting, it means that it is stored for 20 days and then circulated.

③ create

Sets whether to back up the log file and create a new file. In other words, it specifies whether to create an empty log file after rotate.

④ compress

Change to compress the backed up log file. The default value is uncompressed.

Uncommenting will compress the backup file with gzip.

⑤ include /etc/logrotate.d

Loads a directory with log rotation information . The log rotation file for RPM is located in /etc/logrotate.d.

/var/log/wtmp {
    create 0664 root utmp
        minsize 1M
    rotate 1

Cycles the log every month.
Permission 664, the owner is root, the group is utmp.
The minimum size is 1M.
It cycles every month.

/var/log/btmp {
    create 0600 root utmp
    rotate 1

If there is no log file, no error processing is performed.
Cycles the log every month.
Permission 600, the owner is root, and the group is utmp.
It cycles every month.

The default values are shown below.

Absolute path / file name of the file to be cycled {

               rotate Retention period                size size                missing ok                postrotate                Command to perform after cycling                end script


You can also add content to the /etc/logrotate.d directory to make it a file.

Log information to be periodically managed is stored in /etc/logrotate.d.

  4.2.1 Additional Options

  • compresscmd: Specifies a non-gzip compression program.
  • uncompresscmd: Specifies the uncompress command. The default value is gunzip.
  • compressext: Sets the extension to be given to the compressed backup log file.
  • compressoptions: Set options for the compression program. If default is gzip, specify -9fh.
  • dateext: Adds an extension to the log file that is processed daily, in the format YYYYMMDD.
  • error []: If an error occurs during logrotate operation, mail is sent to the specified mail address.
  • extention: Specifies the extension of the rotated log file.
  • ifempty: Cycles (rotates) even if the log file is empty. This is the default value.
  • noifempty: Does not cycle (rotate) if the log file is empty.
  • mail []: Sends the old log file to the specified mail address after logrotate operation.
  • nomail: Do not send mail.
  • mailfirst []: Send mail to the specified mail address of the old log file in logrotate operation.
  • maxage []: Deletes backup log files older than the number specified by count.
  • missing ok: If there is no log file, it is not treated as an error.
  • prerotate / endscript: Runs the specified job (script) before the logrotate operation.

  4.3 /etc/logrotate.d

Settings for each log file are described in a file for each service in /etc/logrotate.d/. For example, if you want to set up a system for logrotate, Create a file in this path and fill in the desired settings.

The file name does not matter, but please enter it in a name that other administrators can easily recognize.

Next, test the set logrotate. The -d option is a test option that is not actually executed.

#/usr/sbin/logrotate -d /etc/logrotate.d/ The name of the file you created

Once the test is complete, run logrotate.

#/usr/sbin/logrotate /etc/logrotate.d/ The name of the file

If you run the first command above, nothing will happen. This is because logrotate checks whether the specified time period has passed through the /var/lib/logroate.status file when it is executed, because there is no information in the related file. The /var/lib/logrotate.status file only logs the current date and logrotate does not run.

Since logroate is not a daemon, it does not run by itself. That's why you have to register with cron. The schedule time is changed. The /etc/cron.daily/logrotate shell script is invoked, and when it is complete, the result file is created in /var/lib/logrotate.status so you can see when it was done.

※ Note

On a Linux server, logrotate is registered as a cron job in the /etc/cron.daily directory and is set to run every day.

Please refer to the following post for how to use crontab!

How to use crontab