Back to the main page

logrotate - rotates and compresses log files


Logrotate : rotation and compression of system log files

Why I need it

You will realize that your log files are endlessly growing and you need to manage them in more elegant way.

Where to get it and how to install it

I like to take it from Blastwave using pkg-get. Check available package:
# pkg-get -a | grep logrotate
 logrotate 3.7.4,REV=2007.01.16
Install it:
# pkg-get -i logrotate
And you have it:
# pkginfo |grep logrotate
application CSWlogrotate    logrotate - rotates, compresses, and mails system logs
To get more info:
# pkginfo -l CSWlogrotate
   PKGINST:  CSWlogrotate
      NAME:  logrotate - rotates, compresses, and mails system logs
  CATEGORY:  application
      ARCH:  sparc
   VERSION:  3.7.4,REV=2007.01.16
   BASEDIR:  /
    VENDOR: packaged for CSW by Frederic Van De Vede
    PSTAMP:  ra20070116145115
  INSTDATE:  Jul 02 2009 19:45
    STATUS:  completely installed
     FILES:       14 installed pathnames
                   7 shared pathnames
                   9 directories
                   1 executables
                 165 blocks used (approx)

How to use it

As usual, check man page. I was installing syslog-ng (centralized log server), and even it supports log rotation, logrotate is used for this purpose (same as used to rotate/compress files from syslogd). Run logrotate every midnight, with -f forcing to do work even it does not want, and with -s tells what state file to use. In this example I have two locations of log files and logrotate is doing work for each of them.
# crontab -l
# logrotate for syslog-ng
0 0 * * * /opt/csw/bin/logrotate -f -s /logs/hosts/.logrotate.status /etc/csw/logrotate.conf.hosts
0 0 * * * /opt/csw/bin/logrotate -f -s /logs/services/.logrotate.status /etc/csw/
Example of configuration for one of logging locations (hope comments are clear, check man page for more info):
#cat /etc/csw/logrotate.conf.hosts

# Global options:

# Compress old log files

# Use this compress command
compresscmd     /usr/bin/gzip

# Rotate log files every day

# It's okay if logfile is missing, maybe host doesn't log every day

# Move rotated files here
olddir /logs/hosts/.archive

# Rotate files for 90 days and them remove them, so keep them 3 months
rotate 90

# Start rotated extension with 0
start 0

# Does three actions below after all log files are rotated and if at least one log file is rotated
/logs/hosts/*:*log {
                /usr/sbin/svcadm refresh  svc:/system/syslog-ng:default
                logger -p -t logrotate "log file rotated"
                logger -p -t logrotate "log file rotated"
After rotation/compression is over, the logger command is used for adding one-line entry in new log file. -p = used to specify facility.level -t = define tag that will mark each logged line From above example you can expect that new log file starts with the line: Aug 3 00:00:01 hostname logrotate: [ID 702911] log file rotated Please check man page for logger.
Back to the main page