logrotate allows you to ease administration of large numbers of log files by rotating, compressing or removing old logs.

Table of Contents

Installation

logrotate is installed on some distros (like MX Linux). Run logrotate --version to see if it’s installed. If not, install it with a package manager (apt, pacman, etc.).

If your system has systemd, logrotate installation will create a service and timer files (logrotate.service, logrotate.timer). You can check my posts about systemd services and systemd timers. You may need to start and enable logrotate.timer (check systemctl status logrotate.timer, run systemctl enable --now logrotate.timer as root if it shows as disabled).

If you don’t have systemd installed (your system uses another init program, like sysVinit), logrotate creates a cron file inside /etc/cron.daily/.

Configuration files

Location

These files are usually inside /etc/logrotate.d/. /etc/logrotate.conf is the main logrotate configuration file. If you open this file, you will be able to see this line:

include /etc/logrotate.d

That means logrotate will check this folder for configuration files.

Structure

This is a simple example of a configuration file:

/var/log/myservice.log {
  weekly
  rotate 5
  compress
}
  • You can specify one file or several (using wildcards: * or spaces: /var/log/file.log /var/log/another.log). Use quotes if filenames have spaces.
  • weekly: logs rotate once a week.
  • rotate 5: logs rotate 5 times before being removed.
  • compress: logs will be compressed to save space.

There are lots of options:

  • olddir <directory>: logs are moved to <directory> on each rotation.
  • hourly | daily | weekly | monthly | yearly: you can rotate logs every hour, day, week, month or year.
  • size <size>: logs are rotated only if their size is bigger than <size>. You can use suffixes like k, M, G. If there is no suffix, size is in bytes. “This option is mutually exclusive with the time interval options, and it causes log files to be rotated without regard for the last rotation time, if specified after the time criteria (the last specified option takes the precedence).” (from logrotate man page).
  • maxsize <size>: similar to size, but when maxsize is used, both the size and timestamp are considered to decide to rotate a log file. If file is bigger than <size>, it will be rotated even before specified time interval.
  • maxage <days>: remove logs older than <days>.
  • missingok: if the log file is missing, go on to the next one without issuing an error message.
  • su <user> <group>: rotate log files set under this user and group instead of using default user/group (usually root).
  • Check man page for more options.

If you have any suggestion, feel free to contact me via social media or email.