Logrotate - ArchWiki

Jump to content
From ArchWiki

Related articles

- Cron
- systemd/Timers

From https://github.com/logrotate/logrotate:

  The logrotate utility is designed to simplify the administration of log files on a system which generates a lot of log files. Logrotate allows for the automatic rotation compression, removal and mailing of log files. Logrotate can be set to handle a log file daily, weekly, monthly or when the log file gets to a certain size.

By default, logrotate's rotation consists of renaming existing log files with a numerical suffix, then recreating the original empty log file. For example, `/var/log/syslog.log` is renamed `/var/log/syslog.log.1`. If `/var/log/syslog.log.1` already exists from a previous rotation, it is first renamed `/var/log/syslog.log.2`. (The number of backlogs to keep can be configured.)

## Installation

Logrotate can be installed with the logrotate package.

By default, logrotate runs daily using a systemd timer: `logrotate.timer`.

## Configuration

The primary configuration file for logrotate which sets default parameters is `/etc/logrotate.conf`; additional application-specific configuration files are included from the `/etc/logrotate.d` directory. Values set in application-specific configuration files override those same parameters in the primary configuration file. See logrotate.conf(5) for configuration examples and a reference of available directives.

To verify if logrotate works correctly, run it in debug mode, in this mode it does nothing except producing debug output:

    $ logrotate --debug /etc/logrotate.conf

### Compressing logs

Logrotate can compress logs with a custom command like `zstd`.

    /etc/logrotate.conf

    compress
    compresscmd /usr/bin/zstd
    compressext .zst
    compressoptions -T0 --long
    uncompresscmd /usr/bin/unzstd

See logrotate.conf(5) and zstd(1) for more details.

## Usage

logrotate is usually run through the systemd service: `logrotate.service`.

To run logrotate manually:

    # logrotate /etc/logrotate.conf

To rotate a single log file:

    # logrotate /etc/logrotate.d/mylog

To simulate running your configuration file (dry run):

    # logrotate --debug /etc/logrotate.d/mylog

To force running rotations even when conditions are not met, run:

    # logrotate -vf /etc/logrotate.d/mylog

See logrotate(8) for more details.

## Troubleshooting

### exim log not rotated

If you have set the `olddir` variable in `/etc/logrotate.conf`, you will get a message such as:

`error: failed to rename /var/log/exim/mainlog to /var/log/old/mainlog.1: Permission denied`

To fix this, add the user `exim` to the group `log`. Then change the group of the `olddir`, usually `/var/log/old`, to `log` instead of the default `root`.

### Check logrotate status

Logrotate rotations are usually logged to `/var/lib/logrotate.status` (the `-s` option allows you to specify another state file):

    /var/lib/logrotate.status

    "/var/log/mysql/query.log" 2016-3-20-5:0:0
    "/var/log/samba/samba-smbd.log" 2016-3-21-5:0:0
    "/var/log/httpd/access_log" 2016-3-20-5:0:0
    ...

### Skipping log because parent directory has insecure permission

Configure which user and which group has to job `/etc/logrotate.d/job` to be run with:

    file-to-be-rotated {
        su user group
        rotate 4
    }

## See also

- Gentoo:Logrotate
- logrotate(8) manual page
- logrotate.conf(5) manual page

Categories:

- Logging
- Data compression and archiving