{"id":1029,"date":"2018-10-21T20:08:28","date_gmt":"2018-10-21T17:08:28","guid":{"rendered":"http:\/\/kifarunix.com\/?p=1029"},"modified":"2024-03-11T20:03:09","modified_gmt":"2024-03-11T17:03:09","slug":"how-to-configure-log-rotation-with-logrotate-on-ubuntu-18-04-lts","status":"publish","type":"post","link":"https:\/\/kifarunix.com\/how-to-configure-log-rotation-with-logrotate-on-ubuntu-18-04-lts\/","title":{"rendered":"How To Configure Log Rotation with Logrotate on Ubuntu 18.04 LTS"},"content":{"rendered":"\n

One of the most essential task for a system administrator is the ability to manage log files. Log rotation is an automated process in which dated log files are archived. It provides a way to limit the total size of the logs retained. In this tutorial, we are going to learn how to configure log rotation with logrotate<\/strong> on Ubuntu 18.04 LTS.<\/p>\n\n\n\n

You may also want to check our previous tutorial on How to Configure Remote Logging with Rsyslog on Ubuntu 18.04<\/a>.<\/p>\n\n\n\n

The logrotate command makes it easy to administer systems that generate large amount of logs. It allows automatic rotation, compression, removal, and mailing of log files. These log files maybe processed on a daily, weekly or monthly basis or whenever they grow beyond specific size.<\/p>\n\n\n\n

Installing Logrotate on Ubuntu<\/h3>\n\n\n\n

Logrotate is installed by default on Ubuntu 18.04. To verify this, check the installed version by running the command below;<\/p>\n\n\n\n

# logrotate --version\nlogrotate 3.11.0<\/pre>\n\n\n\n
If it is not installed, run the command below to install it.<\/p>\n\n\n\n
# apt-get install logrotate -y<\/pre>\n\n\n\n
Logrotate Configuration files<\/h3>\n\n\n\n
There are two major configuration files for logrotate;<\/p>\n\n\n\n
    \n
  • \/etc\/logrotate.conf
    <\/strong>– Defines global options that apply to every log file.<\/li>\n\n\n\n
  • \/etc\/logrotate.d\/
    <\/strong>– Defines configuration options for specific log files. Packages that are installed on the system and requires log rotation places their log rotation configuration files here.<\/li>\n<\/ul>\n\n\n\n
    Before we can dive deeper, let us explore these configuration files;<\/p>\n\n\n\n
    # less \/etc\/logrotate.conf<\/pre>\n\n\n\n
    # see \"man logrotate\" for details\n# rotate log files weekly\nweekly\n\n# use the syslog group by default, since this is the owning group\n# of \/var\/log\/syslog.\nsu root syslog\n\n# keep 4 weeks worth of backlogs\nrotate 4\n\n# create new (empty) log files after rotating old ones\ncreate\n\n# uncomment this if you want your log files compressed\n#compress\n\n# packages drop log rotation information into this directory\ninclude \/etc\/logrotate.d\n\n# no packages own wtmp, or btmp -- we'll rotate them here\n\/var\/log\/wtmp {\n    missingok\n    monthly\n    create 0664 root utmp\n    rotate 1\n}\n\n\/var\/log\/btmp {\n    missingok\n    monthly\n    create 0660 root utmp\n    rotate 1\n}\n\n# system-specific logs may be configured here<\/pre>\n\n\n\n
    Below is a brief description of the directives that can be used on the logrotate configuration files;<\/p>\n\n\n\n
      \n
    • weekly<\/strong> – Rotates log files every week. Simillar directives include;\n
        \n
      • daily
        <\/em><\/li>\n\n\n\n
      • monthly<\/li>\n\n\n\n
      • yearly<\/li>\n<\/ul>\n<\/li>\n\n\n\n
      • su user group<\/em><\/strong> – Rotate log files set under this user and group instead of using default user\/group (usually root). user\/group<\/strong><\/em> specifies the user\/group used for rotation.<\/li>\n\n\n\n
      • rotate<\/strong> count<\/strong> – <\/em>Log files are rotated count<\/em> times before being removed or mailed to the address specified in a mail directive. So rotate 4<\/strong><\/em> would keep only four rotated log files. If the value 0 is specified, old log files are removed instead of rotated<\/li>\n\n\n\n
      • create [mode owner group<\/em>], create [owner group]<\/em><\/strong> – creates the log file immediately after rotation. mode<\/strong><\/em> specifies the mode for the log file in octal format e.g 0660<\/strong>, <\/em>owner <\/strong><\/em>specifies the user name who will own the log file, group<\/strong><\/em> specifies the group the log file will belong to.\n
          \n
        •  nocreate <\/strong>– New log files are not created<\/li>\n<\/ul>\n<\/li>\n\n\n\n
        • compress<\/strong> – compresses the old log files with gzip<\/strong> by default. Similar directives include;\n
            \n
          • nocompress<\/strong> – Do not compress old log files.<\/li>\n\n\n\n
          • compresscmd<\/strong> – Specifies the command to be used for compressing<\/li>\n\n\n\n
          • uncompresscmd<\/strong> – Specifies which command to use to uncompress log files e.g gunzip.<\/li>\n\n\n\n
          • compressext<\/strong> – Specifies which extension to use on compressed logfiles, if compression is enabled. The default follows that of the configured compression command.<\/li>\n\n\n\n
          • compressoptions<\/strong> – Specifies any options to be passed to the compression program
            used.<\/li>\n\n\n\n
          • delaycompress<\/strong> – Postpones the compression of log files to the next rotation of log files<\/li>\n<\/ul>\n<\/li>\n\n\n\n
          • include file_or_directory<\/em><\/strong> –<\/em> Reads the file given as an argument as if it was included inline. If a directory is given for example \/etc\/logrotate.d<\/strong><\/em>, most of the files in that directory are read in alphabetic order before processing of the including file continues.
            <\/em><\/li>\n\n\n\n
          •  missingok<\/strong> – If the log file is missing, go on to the next one without issuing an error message. Similar directive is;\n
              \n
            • nomissingok<\/strong> – If a log file does not exist, issue an error<\/li>\n<\/ul>\n<\/li>\n\n\n\n
            • ifempty<\/strong> – Rotate log file even if it empty. Similar directive is\n
                \n
              • notifempty<\/strong> – Do not rotate the log if it is empty<\/li>\n<\/ul>\n<\/li>\n\n\n\n
              • mail ADDRESS<\/em><\/strong> – Enables mailing of log files that have been rotated as many
                times as is defined by the rotate directive to the specified address. Similar directives include:\n
                  \n
                • nomail<\/strong> – Do not mail old log files to any address.<\/li>\n\n\n\n
                • mailfirst<\/strong> – Specifies that the just-rotated log files are to be mailed, instead of the aboutto-expire log files.<\/li>\n\n\n\n
                • maillast<\/strong> – Specifies that the about-to-expire log files are to be mailed, instead of the justrotated log files. This is the default option when mail is enable<\/li>\n<\/ul>\n<\/li>\n\n\n\n
                • maxage<\/strong> count – <\/em>Remove rotated logs older than <count> days.<\/li>\n\n\n\n
                • size <\/strong>size<\/strong><\/em> – Log files are rotated only if they grow bigger than size bytes. If size is followed by k, the size is assumed to be in kilobytes. If the M is used, the size is in megabytes, and if G is used, the size is in gigabytes. Simillar directives include;\n
                    \n
                  • maxsize size <\/em><\/strong>– Log files are rotated when they grow bigger than size<\/em> bytes even before the specified time interval (daily, weekly, monthly, or yearly).<\/li>\n\n\n\n
                  • minsize size <\/em><\/strong>– Log files are rotated when they grow bigger than size<\/em> bytes but not before the specified time interval (daily, weekly, monthly, or yearly).<\/li>\n<\/ul>\n<\/li>\n\n\n\n
                  •  copy<\/strong> – Make a copy of the log file, but don’t change the original at all.Similar directive is;\n
                      \n
                    • copytruncate<\/strong> – Truncate the original log file to zero size in place after creating a copy, instead of moving the old log file and optionally creating a new one.<\/li>\n\n\n\n
                    • nocopy<\/strong> – Do not copy the original log file and leave it in place<\/li>\n\n\n\n
                    • nocopytruncate<\/strong> – Do not truncate the original log file in place after creating a copy<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n
                      For a comprehensive list of directives, check the man pages for logrotate.<\/p>\n\n\n\n
                      Creating Custom Configuration Files<\/h2>\n\n\n\n
                      The \/etc\/logrotate.d <\/strong>contains custom specific configurations that overrides the default configurations defined in \/etc\/logrotate.conf.<\/strong><\/em> <\/strong>In this section we will be going through examples of various configurations.<\/p>\n\n\n\n
                      Rotate the log file daily<\/h3>\n\n\n\n
                      # less \/etc\/logrotate.d\/custom.conf\n\/var\/log\/remotelogs\/192.168.43.214\/auth.log {\n        daily\n        missingok\n        notifempty\n        rotate 4\n        compress\n}<\/pre>\n\n\n\n
                      Rotate the log file when they grow more than 1G of size even before the specified time interval of rotation<\/h4>\n\n\n\n
                      # less \/etc\/logrotate.d\/custom.conf\n\/var\/log\/remotelogs\/192.168.43.214\/auth.log{\n        maxsize 1G<\/strong>\n        daily\n        missingok\n        notifempty\n        rotate 4\n        compress\n}<\/pre>\n\n\n\n
                      Remove Rotated files after a specific number of days<\/h4>\n\n\n\n
                      # less \/etc\/logrotate.d\/custom.conf\n\/var\/log\/remotelogs\/192.168.43.214\/auth.log{\n        size 10G\n        maxage 90<\/strong>\n        missingok\n        notifempty\n        rotate 7\n        compress\n}<\/pre>\n\n\n\n
                      Specify compression command for the log file rotation<\/h3>\n\n\n\n
                      # less \/etc\/logrotate.d\/custom.conf\n\/var\/log\/remotelogs\/192.168.43.214\/auth.log{\n        size 10G\n        maxage 90\n        missingok\n        notifempty\n        rotate 7\n        compress\n        compresscmd \/bin\/bzip2<\/strong>\n        compressext .bz2<\/strong>\n}<\/pre>\n\n\n\n
                      Run specific commands after rotating log files<\/h3>\n\n\n\n
                      # less \/etc\/logrotate.d\/custom.conf\n\/var\/log\/remotelogs\/192.168.43.214\/sshd.log {\n        rotate 5\n        weekly\n        sharedscripts<\/strong>\n        postrotate<\/strong>\n        \/usr\/bin\/killall -HUP rsyslogd\n        endscript\n}<\/pre>\n\n\n\n
                      The sharedscripts<\/strong> means that the postrotate script will only be run once (after the old logs have been compressed), not once for each log which is rotated.<\/p>\n\n\n\n
                      Append date to the log files after rotation<\/h3>\n\n\n\n
                      # less \/etc\/logrotate.d\/custom.conf\n\/var\/log\/remotelogs\/192.168.43.214\/sshd.log{\n        size 200k\n        missingok\n        notifempty\n        rotate 7\n        compress\n        dateext\n        dateformat -%Y-%m-%d\n}<\/pre>\n\n\n\n
                      Mail rotated log files uncompressed after 5 rotations<\/h4>\n\n\n\n
                      # less \/etc\/logrotate.d\/custom.conf\n\/var\/log\/remotelogs\/192.168.43.214\/auth.log {\n        rotate 5\n        mail example@example.com\n        size 50k\n        daily\n        missingok\n        notifempty\n}<\/pre>\n\n\n\n
                      That is all we could cover on this article. For a comprehensive list of logrotate directives, check the man pages for logrotate. Thank you for reading.<\/p>\n","protected":false},"excerpt":{"rendered":"
                      One of the most essential task for a system administrator is the ability to manage log files. Log rotation is an automated process in which<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"rank_math_lock_modified_date":false,"footnotes":""},"categories":[121,191],"tags":[194,186],"class_list":["post-1029","post","type-post","status-publish","format-standard","hentry","category-howtos","category-rsyslog","tag-logrotate","tag-rsyslog","generate-columns","tablet-grid-50","mobile-grid-100","grid-parent","grid-50"],"_links":{"self":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts\/1029"}],"collection":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/comments?post=1029"}],"version-history":[{"count":5,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts\/1029\/revisions"}],"predecessor-version":[{"id":21031,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts\/1029\/revisions\/21031"}],"wp:attachment":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/media?parent=1029"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/categories?post=1029"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/tags?post=1029"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}