How to use logrotate to manage Linux log files

Log files in Linux systems are important resources for recording system operation and troubleshooting. However, as time goes by, log files will continue to grow, occupying a large amount of disk space, and are not conducive to log viewing and analysis. In order to solve this problem, we can use the logrotate tool to automatically rotate, compress, delete, and send emails to log files to achieve effective management of log files. This article will introduce the basic principles, configuration files and common options of the logrotate tool, as well as how to configure logrotate strategies for different applications.

How logrotate works

By default, the logrotate command is run once a day as a cron task placed in /etc/cron.daily. It will help you set a policy in which log files exceeding a certain time or size are rotated.
Order:

/usr/sbin/logrotate

Configuration file: /etc/logrotate.conf, this is the main configuration file of logrotate. logrotate also stores service-specific configuration in /etc/logrotate.d/. Make sure the line below is included in /etc/logrotate.conf to read service-specific log configuration.

include  /etc/logrotate.d`

logrotate history: /var/lib/logrotate.status

Important logrotate options:

compress             --> 压缩日志文件的所有非当前版本
daily,weekly,monthly --> 按指定计划轮换日志文件
delaycompress        --> 压缩所有版本，除了当前和下一个最近的
endscript            --> 标记 prerotate 或 postrotate 脚本的结束
errors "emailid"     --> 给指定邮箱发送错误通知
missingok            --> 如果日志文件丢失，不要显示错误
notifempty           --> 如果日志文件为空，则不轮换日志文件
olddir "dir"         --> 指定日志文件的旧版本放在 “dir” 中
postrotate           --> 引入一个在日志被轮换后执行的脚本
prerotate            --> 引入一个在日志被轮换前执行的脚本
rotate 'n'           --> 在轮换方案中包含日志的 n 个版本
sharedscripts        --> 对于整个日志组只运行一次脚本
size='logsize'       --> 在日志大小大于 logsize（例如 100K，4M）时轮换

Configuration

Let's configure logrotate for our own sample log file /tmp/sample_output.log.

Step one: Add the following lines to /etc/logrotate.conf.

/tmp/sample_output.log {
  size 1k
  create 700 root root
  rotate 4
  compress
}

In the above configuration file:

size 1k - logrotate 仅在文件大小等于（或大于）此大小时运行。
create - 轮换原始文件并创建具有指定权限、用户和组的新文件。
rotate - 限制日志文件轮转的数量。因此，这将只保留最近的 4 个轮转的日志文件。
compress - 这将压缩文件。

Step 2: Usually, you need to wait a day for logrotate to be executed by /etc/cron.daily. Otherwise, you can run it from the command line with:

/usr/sbin/logrotate  /etc/logrotate.conf

Output before executing logrotate command:

[root@rhel1 tmp]# ls -l /tmp/
total 28
-rw-------. 1 root root 20000 Jan 1 05:23 sample_output.log

Output after executing logrotate:

[root@rhel1 tmp]# ls -l /tmp
total 12
-rwx------. 1 root root 0 Jan 1 05:24 sample_output.log
-rw-------. 1 root root 599 Jan 1 05:24 sample_output.log-20170101.gz
[root@rhel1 tmp]#

This will confirm that logrotate is successfully implemented.

Through the introduction of this article, we understand the function and usage of the logrotate tool, and how to customize the logrotate strategy according to different needs. The logrotate tool can help us save disk space, improve the readability and usability of log files, and also facilitate us to back up and monitor log files. The logrotate tool is a very practical log management tool in Linux systems and is worth mastering and using.

The above is the detailed content of How to use logrotate to manage Linux log files. For more information, please follow other related articles on the PHP Chinese website!