Generally speaking Logs are very much important part of any troubleshooting activity, However these logs grows in size with time. In this case we need to perform log cleanup manually in order to reclaim the space and its tedious task to administer these logs. To overcome this we can configure logrotate utility available in Linux which automatically does rotation, compression , removal and mailing of logfile.

We can configure logrotate utility so that each log file may be handled daily, weekly, monthly,or when it grows too large.

How logrotate utility works:

By default, the logrotate command runs as a cron job once a day from /etc/cron.daily, and it helps you set a policy where log-files that grow beyond a certain age or size are rotated.

Command: /usr/sbin/logrotate

Configuration File : /etc/logrotate.conf

This is main configuration file for logrotate utility.The logrotate configuration files are also stored for specific services in the directory “/etc/logrotate.d/”.  Make sure below code exists in /etc/logrotate.conf for reading out service specific log rotation configuration.

include /etc/logrotate.d

Logrotate History: /var/lib/logrotate.status   –

Important logrotate utility options:

compress             --> Compresses all noncurrent versions of the log file
daily,weekly,monthly -->Rotating log files on the specified schedule
delaycompress        -->Compresses all versions but current and next-most-recent
endscript            --> Marks the end of a prerotate or postrotate script
errors "emailid"     --> Email error notification to specified emailaddr
missingok            --> Do not complain if log file is missing
notifempty           -->  Does not rotate the log file if it is empty
olddir "dir"         --> Specifies that older verions of the log file be placed in "dir"
postrotate           --> Introduce a script to be run after log has been rotated
prerotate            -->Introduce a script to be run before any changes are made
rotate 'n'           -->Include 'n' versions of the log in the rotation scheme
sharedscripts        -->Runs scripts only once for the entire log group
size='logsize'       -->Rotates if log file size > 'logsize (eg 100K, 4M)

Let’s configure logrotate utility for our own sample log file “/tmp/sample_output.log”.

Step1: Add below lines of code in the “/etc/logrotate.conf” file.

/tmp/sample_output.log {
size 1k
create 700 root root
rotate 4
compress
}

In the above configuration code:

• size 1k – logrotate runs only if the file size is equal to (or greater than) this size.
• create – rotate the original file and create the new file with specified permission, user and group.
• rotate – limits the number of log file rotation. So, this would keep only the recent 4 rotated log files.
• compress– This will compress the file.

Step 2: Normally, you would have to wait a day until logrotate is started from /etc/cron.daily. As an alternative, you can run it from the command line using the following command:

/usr/sbin/logrotate /etc/logrotate.conf

Output Before execution of logrotate command:

[root@rhel1 tmp]# ls -l /tmp/
total 28
-rw-------. 1 root root 20000 Jan 1 05:23 sample_output.log

Output After execution of logrotate command:

[root@rhel1 tmp]# ls -l /tmp
total 12
-rwx------. 1 root root 0 Jan 1 05:24 sample_output.log
-rw-------. 1 root root 599 Jan 1 05:24 sample_output.log-20170101.gz
[root@rhel1 tmp]#

So this confirms successful implementation of logrotate utility.