Rotating Logs in Linux servers.

While troubleshooting the Linux servers, log plays an important role but when we have limited hard disk space to work on, logs can take lot of hard disk space. I faced this issue several times, when the hard disk got full because of application logs, apache logs and other system logs which finally resulted to application error or low disk error. For this either we need to use logrotate option or we need to delete old log manually.

logrotate is designed to ease administration of systems that generate large numbers of log files. It allows automatic rotation, compression,removal, and mailing of log files. Each log file may be handled daily weekly, monthly, or when it grows too large.

If you want to rotate your logs daily, do the following changes.
cd /etc/logrotate.conf
# rotate log files weekly
weekly # you can change it to 'daily' 'weekly' or 'monthly' also
# keep 4 weeks worth of backlogs
rotate 4
# create new (empty) log files after rotating old ones
create
# uncomment this if you want your log files compressed
compress
# packages drop log rotation information into this directory
include /etc/logrotate.d
# no packages own wtmp, or btmp -- we'll rotate them here
/var/log/wtmp {
missingok
monthly
create 0664 root utmp
rotate 1
}
/var/log/btmp {
missingok
monthly
create 0660 root utmp
rotate 1
}
# system-specific logs may be configured here

Save the file.

For the rotation of other logs, you can make changes in files in /etc/logrotate.d/. Here I am giving the example to rotate apache logs.

vi /etc/logrotate.d/apache2
/var/log/apache2/*.log {
daily #rotate logs daily
missingok
rotate 52
compress # compress the logs also
delaycompress
notifempty
create 640 root adm
sharedscripts
maxage 15 # deletes the log which are older than 15 days.
postrotate
if [ -f "`. /etc/apache2/envvars ; echo ${APACHE_PID_FILE:-/var/run/apache2.pid}`" ]; then
/etc/init.d/apache2 reload > /dev/null
fi
endscript
}

Do the changes and save the file.

logrotate script runs daily as it is kept /etc/cron.daily, if you want run it manually to test the changes you have done.
# cd /etc/cron.daily
# ./logrotate

Now you can see the changes in /var/log/apache directory that all the log are converted in .gz format and only 15 days old logs are there. You can make similar changes for the other application and system logs.

 

 

Leave a Reply