Logrotate-3.21.0

Configuring Logrotate

Logrotate needs a configuration file, which must be passed as an argument to the command when executed. Create the file as the root user:

cat > /etc/logrotate.conf << EOF
# Begin /etc/logrotate.conf

# Rotate log files weekly
weekly

# Don't mail logs to anybody
nomail

# If the log file is empty, it will not be rotated
notifempty

# Number of backups that will be kept
# This will keep the 2 newest backups only
rotate 2

# Create new empty files after rotating old ones
# This will create empty log files, with owner
# set to root, group set to sys, and permissions 664
create 0664 root sys

# Compress the backups with gzip
compress

# No packages own lastlog or wtmp -- rotate them here
/var/log/wtmp {
    monthly
    create 0664 root utmp
    rotate 1
}

/var/log/lastlog {
    monthly
    rotate 1
}

# Some packages drop log rotation info in this directory
# so we include any file in it.
include /etc/logrotate.d

# End /etc/logrotate.conf
EOF

chmod -v 0644 /etc/logrotate.conf

Now create the /etc/logrotate.d directory as the root user:

mkdir -p /etc/logrotate.d

At this point additional log rotation commands can be entered, typically in the /etc/logrotate.d directory. For example:

cat > /etc/logrotate.d/sys.log << EOF
/var/log/sys.log {
   # If the log file is larger than 100kb, rotate it
   size   100k
   rotate 5
   weekly
   postrotate
      /bin/killall -HUP syslogd
   endscript
}
EOF

chmod -v 0644 /etc/logrotate.d/sys.log

You can designate multiple files in one entry:

cat > /etc/logrotate.d/example.log << EOF
file1
file2
file3 {
   ...
   postrotate
    ...
   endscript
}
EOF

chmod -v 0644 /etc/logrotate.d/example.log

You can use in the same line the list of files: file1 file2 file3. See the logrotate man page or https://www.techrepublic.com/article/manage-linux-log-files-with-logrotate/ for more examples.

The command logrotate /etc/logrotate.conf can be run manually, however, the command should be run daily. Other useful commands are logrotate -d /etc/logrotate.conf for debugging purposes and logrotate -f /etc/logrotate.conf forcing the logrotate commands to be run immediately. Combining the previous options -df, you can debug the effect of the force command. When debugging, the commands are only simulated and are not actually run. As a result, errors about files not existing will eventually appear because the files are not actually created.

To run the logrotate command daily, execute the following commands, as the root user, to create a systemd timer to run daily at 3:00 A.M. (local time):

cat > /usr/lib/systemd/system/logrotate.service << "EOF" &&
[Unit]
Description=Runs the logrotate command
Documentation=man:logrotate(8)
DefaultDependencies=no
After=local-fs.target
Before=shutdown.target

[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=/usr/sbin/logrotate /etc/logrotate.conf
EOF
cat > /usr/lib/systemd/system/logrotate.timer << "EOF" &&
[Unit]
Description=Runs the logrotate command daily at 3:00 AM

[Timer]
OnCalendar=*-*-* 3:00:00
Persistent=true

[Install]
WantedBy=timers.target
EOF
systemctl enable logrotate.timer