Comments on: Rotating Linux Log Files

By: harish

harish — Thu, 02 Dec 2010 04:22:17 +0000

/var/log/ftp.log file size is big.
i would like to ratate file with cron for monthly scheduld.
please help me for ‘Logrotate’ script.

By: mike

mike — Mon, 29 Nov 2010 18:40:27 +0000

I have a one question. Maybe someone know, how to set the system to start rotation (creating archives, etc.) by starting system?

By: Linux Logrotate Setup « Eager to Code, Enjoy to Debug ~ Embark into Each Stage with Your Heart

Sun, 29 Jun 2008 08:54:35 +0000

[...] Further information about logrotate:- http://linuxcommand.org/man_pages/logrotate8.html http://www.ducea.com/2006/06/06/rotating-linux-log-files/ [...]

By: - Marius -

- Marius - — Thu, 08 Jun 2006 15:02:03 +0000

fak3r ,

Thank you very much for your nice words. It really helps to know that other peoples find useful what I am writing. This is really the greatest reward I can expect when doing this…

Regarding your comment about syslog… there is an option in syslog that could have been useful to you:
olddir “directory”
= old logs are moved into “directory” for rotation
But this has an important limitation: olddir must be on the same physical drive as the log file being rotated. Now depending from your case this could have been useful (if the partition was the problem and you had enough space on another partition), or not (if you needed the logs saved on another drive – still you could have solved this by placing the logs on that drive in the first place, and solve it like that). Anyway if you are happy with the solution you found, then this is all that matters. This is the beauty of the Linux world that you can find so many different solutions to achieve the same purpose.

Cheers
- Marius -

By: fak3r

fak3r — Thu, 08 Jun 2006 14:07:02 +0000

Marius
This is a great primer, wish I would have found it a year back when I was trying to learn this stuff, the docs confused me (Google for examples came to the rescue then) but I needed to learn since my hardrive (and /var in particular) was smaller thna I wanted. Now I’m using newsyslog, sort of an enhanced version of syslog; same basic principals apply, but is gaining popularity among the *BSDs (but can be compiled/installed for Linux easily too, prob in debs). I write HOWTOs on my site as well, but most aren’t this detailed, as this could serve the community better than the project’s current doc.

fak3r

By: - Marius -

- Marius - — Wed, 07 Jun 2006 23:05:50 +0000

Chris,

Thank you very much for your comment. I too find that the dateext option quite cool, especially for rotating apache log files daily (at least here I have needed it). If you will save the logs for an extended period of time then this is quite a great option to use.

The way RedHat based systems (RHEL, Fedora, Centos, etc) handle the rotation of ‘system log files’ is a little different than in Debian based systems: this is handled by logrotate itself, and actually I will post an update to the original post, to not create confusions about this. I don’t have a Suse system available to look at it but I assume that it will follow the RedHat path, but please confirm that if you can. Thanks.

By: Chris Riney

Chris Riney — Wed, 07 Jun 2006 22:06:55 +0000

I’m glad that he mentioned that this was based on a Debian systems, since the RedHat & SuSE systems that I work with do not have the syslog “Feature” that is described (must be part of syslogNG which I’m not familiar with). Both of these major commercial distributions manage the syslog files via logrotate.

Actually I’m just starting to work with SuSE Enterprise, and I’m noticing the differences in the way RedHat & SuSE implement scheduling Hourly, Daily, Weekly, & Monthly rotations.

A feature of of LogRotate 3.7.x that I found, (and was looking for) is the ‘dateext’ which appends the rotation date to the end instead of a sequential number. The problem I have with the sequential number, is that logrotate moves the older log’s up the sequence, which causes those file to be backed-up multiple times with differential backups.

One item that you didn’t cover, is how logrotate knows when it is the proper time to rotate a daily, weekly, or monthly file. Part of that is controlled by the status file (/var/lib/logrotate.status on most Linux system) which tracks when a particular file was last rotated. The other part is that Monthly rotations are done with the first run of logrotate that month, and Weekly’s are run if the last run was later in the previous week, or the last rotation was over 7 days prior (Sunday=0 Saturday=6). So if you are running logrotate daily, then it works itself out to the first day of the month, and Sunday’s for the weeklies.