Logrotate is a powerful system tool that automatically manages log files by compressing, rotating, and removing old logs to save disk space and keep your server organized. Setting up logrotate involves creating a cron job to run it regularly and configuring rotation rules in /etc/logrotate.conf and /etc/logrotate.d/ directory files. This guide walks you through the complete setup process, from basic configuration to advanced options like compression and custom rotation intervals.
Running Logrotate Automatically
Logrotate only processes log files when it runs, regardless of your configuration settings. For example, if you configure daily rotation but logrotate only runs weekly, your logs will only rotate weekly. To ensure regular log rotation, you need to set up logrotate as a cron job.
Most Linux systems run logrotate from a script in the /etc/cron.daily/ directory. If this script doesn't exist on your system, create one with the following content:
File: /etc/cron.daily/logrotate
#!/bin/sh logrotate /etc/logrotate.conf
Make sure the script is executable by running: chmod +x /etc/cron.daily/logrotate
Alternatively, you can add an entry directly to the root user's crontab for more granular control over when logrotate runs.
Understanding the Logrotate Configuration File
The main configuration file /etc/logrotate.conf contains global directives that apply to all log files unless overridden. However, most specific log rotation settings are stored in individual files within the /etc/logrotate.d/ directory. Each daemon process or application typically has its own configuration file in this directory.
The logrotate.conf file loads these individual configurations using this directive:
include /etc/logrotate.d
Configuration for specific logs uses a block structure. Here's an example for rotating mail server logs:
/var/log/mail.log {
weekly
rotate 5
compress
compresscmd xz
create 0644 postfix postfix
}This configuration rotates the mail log weekly, keeps the last five rotated versions, compresses old logs using xz, and creates new log files with 0644 permissions owned by the postfix user and group. Settings within these blocks override global configurations.
Configuring Log Rotation Count
The rotate directive controls how many previous log versions to keep before deletion. Here's how to configure it:
rotate 4
This example keeps four old log versions. Setting rotate to 0 removes logs immediately after rotation. If you configure an email address with the mail directive, logrotate will email old logs before removing them:
mail admin@example.com
Note that your system needs a working mail transfer agent (MTA) to send emails.
Setting Rotation Intervals
Logrotate offers several time-based rotation options to match your needs.
Weekly Rotation
To rotate logs every week, use:
weekly
Logs rotate when the current weekday is earlier than the last rotation day (for example, Monday is earlier than Friday) or when more than a week has passed since the last rotation.
Monthly Rotation
For monthly rotation, use:
monthly
Logs rotate on the first day of each month when logrotate runs.
Yearly Rotation
For annual rotation, use:
yearly
Logs rotate when the current year differs from the year of the last rotation.
Size-Based Rotation
To rotate based on file size instead of time, use:
size [value]
The value defaults to bytes. Append k for kilobytes, M for megabytes, or G for gigabytes. For example, size 100M rotates logs when they exceed 100 megabytes.
Configuring Log Compression
Compression saves significant disk space by compressing rotated logs. Enable compression globally or for specific logs:
compress
This directive compresses all rotated logs. To disable compression for a specific log when it's enabled globally, use:
nocompress
By default, logrotate uses gzip for compression. You can specify a different compression tool:
compresscmd xz
This example uses xz compression instead of gzip. Other options include bzip2 or any compression utility available on your system.
Delaying Log Compression
Sometimes you need to process rotated logs before compression. The delaycompress directive postpones compression by one rotation cycle:
delaycompress
This is useful when applications need to finish writing to recently rotated log files or when post-processing scripts need to analyze uncompressed logs.
Maintaining File Extensions
By default, logrotate appends numbers to filenames (access.log becomes access.log.1). To preserve the file extension, use:
extension log
With this setting, access.log rotates to access.1.log. If compression is enabled, the compressed file will be access.1.log.gz, keeping the .log extension visible in the filename.
Controlling New Log File Permissions
Some applications require log files to exist with specific permissions to function properly. Logrotate can create new empty log files after rotation with the correct permissions:
create 640 www-data users
This creates a new log file with 640 permissions (owner read/write, group read, others none), owned by the www-data user and the users group. The syntax is: create [mode] [owner] [group]
This ensures your web server or application can immediately start writing to the new log file without permission errors.
Example Logrotate Configuration for OBHost
Here's a practical example configuration for a web server log at /var/log/apache2/access.log:
/var/log/apache2/access.log {
daily
rotate 14
compress
delaycompress
notifempty
create 0640 www-data adm
sharedscripts
postrotate
systemctl reload apache2 > /dev/null
endscript
}This configuration rotates logs daily, keeps 14 days of history, compresses old logs (except the most recent), skips empty logs, creates new files with appropriate permissions, and reloads Apache after rotation.
Frequently Asked Questions
How do I test my logrotate configuration before deploying it?
Run logrotate in debug mode with the -d flag: logrotate -d /etc/logrotate.conf. This shows what logrotate would do without actually rotating any files. For verbose output during actual rotation, use the -v flag instead.
Why aren't my logs rotating even though I configured logrotate?
Check that logrotate is actually running via cron by examining /var/log/cron or your system's cron logs. Verify that the logrotate script in /etc/cron.daily/ is executable and that your configuration files have correct syntax. You can manually run logrotate -f /etc/logrotate.conf to force rotation for testing.
Can I rotate logs based on both size and time?
While you can specify both size and time directives, logrotate will rotate logs when either condition is met, not both. For example, if you set both daily and size 100M, logs will rotate daily or when they reach 100MB, whichever comes first.
How do I prevent logrotate from removing old logs?
Set the rotate directive to a high number to keep many old versions, or set it to 0 and configure the mail directive to email logs instead of deleting them. You can also use the maxage directive to specify how many days to keep rotated logs before deletion.
Setting up logrotate properly ensures your server maintains clean, organized log files without consuming excessive disk space. The OBHost support team is available 24/7 to help with server management questions. Visit our contact page or email support@obhost.org for assistance with logrotate configuration or any hosting-related issues.
