Logs can be invaluable should you need to hunt for a specific event or root out a problem, but left to their own devices the numerous log files produced by operations and applications can quickly grow well beyond a manageable size. The large .log files can consume space, slow down processes, and become cumbersome to work with. An effective solution to sprawling logs is logrotate, which does precisely what its name implies: it rotates your logs, allowing you to limit the growth of your log files based on time or file size, as well as make sure old- likely unnecessary- logged events aren't slowly swallowing up your drive space.
Your CentOS 6 or 7 installation will include logrotate by default. If you have a barebones Ubuntu 14.04 Server running, you may need to install it first:
sudo apt-get install logrotate
For some, the default rotations might be a perfect fit. First, you need to see what those defaults are.
Holding collective control over all logging instructions across the system is the logrotate.conf file. Let's explore the settings as CentOS deems appropriate. You will need sudo rights for these next steps.
From the command prompt:
sudo vim /etc/logrotate.conf
# see "man logrotate" for details
# rotate log files weekly
weekly
#keep 4 weeks worth of backlogs
rotate 4
# create new (empty) log files after rotating old ones
create
# use date as a suffix of the rotated file
dateext
# uncomment this if you want your log files compressed
#compress
# RPM packages drop log rotation information into this directory
include /etc/logrotate.d
# no packages own wtmp and btmp -- we'll rotate them here
/var/log/wtmp {
monthly
create 0664 root utmp
minsize 1M
rotate 1
}
/var/log/btml {
missingok
monthly
create 0600 root utmp
rotate 1
}
The default settings here already do a good job of letting the user know their function:
Logs will rotate weekly.
Four older logs will be kept (one per week). This is actually a misleading. Were the rotation set to daily, logrotate would not keep 28 logs, but rather would archive the four previous daily logs.
A new .log file will be created as the old one is archived;
The older file will include its date in the file name;
Compression is not being used:
Task-specific logging info will be pulled from the logrotate.d folder.
Not a part of the logging feature of any other application, logrotate will handle logs for who has logged in (wtmp) or failed to (btmp).
You could make changes to the system's overall logging habits here, but it's good practice to make your changes to specific services from within the daemon folder
To access individual application log defaults, one must cd into /etc/logrotate.d
cd /etc/logrotate.d ls
chrony httpd libvirtd libvirtd.qemu ppp samba wpa_supplicant cups iscsiuiolog libvirtd.lxc numad psacct syslog yum
The contents of your /logrotate.d will depend on what you have installed. Here I'm using a sparsely populated installation on a virtual machine, and so there is little to choose from. The methods, however, will be the same. For demonstration's sake, I'll edit the iSCSI output log.
Before making any changes, it's always wise to backup your file:
sudo cp iscsiuiolog iscsiuiolog.old
Let's look at the defaults for iSCSIuiolog:
sudo vim iscsiuolog
/var/log/iscsiuio.log {
weekly
missingok
notifempty
rotate 4
sharedscripts
postrotate
pkill -USR1 iscsiuio 2> /dev/null || true
endscript
}
For the purposes of changing frequency, the lines of importance are line two, which specifies the frequency of rotation, and line five, which dictates the number of logs in rotation. Changing the frequency is as easy as replacing text: daily, weekly, monthly or yearly. Additionally, I've changed the number of logs to keep archived, so the new file looks like this:
/var/log/iscsiuio.log {
daily
missingok
notifempty
rotate 7
sharedscripts
postrotate
pkill -USR1 iscsiuio 2> /dev/null || true
endscript
}
This gives you a general idea of how to change the frequency of your log rotations. A full list of commands can be found in the manpages
man logrotate
- Updated