The Log Rotate ability allows you to specify when your logs are rotated and how the system handles those logs. The log rotation is implemented using the standard unix/linux log rotate function. To change how it is working you need to edit the file /etc/logrotate.conf. If you want to make additions or changes to this file, follow the below instructions for log rotation.
Synopsis
log rotate [-dv] [-f|--force] [-s|--state file ] config _ file +
Description
Log rotation is designed to ease the administration of systems that generate large numbers of log files. It allows automatic rotation, compression, removal, and mailing of log files. Each log file may be handled daily, weekly, monthly, or when it grows too large.
Normally, log rotate is run as a daily cron job. It will not modify a log multiple times in one day unless the criteria for that log is based on the log's size and log rotation is being run multiple times each day or unless the -f or -force option is used.
Any number of config files may be given on the command line. Later config files may override the options given in earlier files, so the order in which the log rotate config files are listed in is important. Normally, a single config file that includes any other config files that are needed should be used. See below for more information on how to use the include directive to accomplish this. If a directory is given on the command line, every file in that directory is used as a config file.
If no command line arguments are given, log rotate will print the version and copyright information, along with a short usage summary. If any errors occur while rotating logs, log rotate will exit with a non-zero status.
Options
-d turns on debug mode and implies -v. In debug mode, no changes will be made to the logs or to the log rotate state file.
-f, --force tells the log to rotate to force the rotation, even if it doesn't think this is necessary. Sometimes this is useful after adding new entries to log rotate or if old log files have been removed by hand, as the new files will be created, and logging will continue correctly.
-m, --mail <command> tells log rotate which command to use when mailing logs. This command should accept two arguments: 1) the subject of the message and 2) the recipient. The command must then read a message on standard input and mail it to the recipient. The default mail command is /bin/mail -s.
-s, --state <statefile> tells the log to rotate to use an alternate state file. This is useful if log rotates are being run as a different user for various sets of log files. The default state file is /var/lib/logrotate.status.
--usage prints a short usage message.
Configuration File
Log rotate reads everything about the log files it should be handling from the series of configuration files specified on the command line. Each configuration file can set global options (local definitions override global ones, and later definitions override earlier ones) and specify a log file to rotate. A simple configuration file looks like this:
# sample log rotate configuration file
compress
/var/log/messages {
rotate 5
weekly
postrotate
/sbin/killall -HUP syslogd
endscript
}
"/var/log/httpd/access.log" /var/log/httpd/error.log {
rotate 5
mail www@my.org
size=100k
sharedscripts
postrotate
/sbin/killall -HUP httpd
endscript
}
/var/log/news/* {
monthly
rotate 2
olddir /var/log/news/old
missingok
post-rotate
kill -HUP `cat /var/run/inn.pid`
endscript
compress
}
The first few lines set global options; in the example, logs are compressed after they are rotated. Note that comments may appear anywhere in the config file as long as the first non-whitespace character on the line is a #.
The next section of the config files defines how to handle the log file /var/log/messages. The log will go through five weekly rotations before being removed. After the log file has been rotated (but before the old version of the log has been compressed), the command /sbin/killall -HUP syslogd will be executed.
The next section defines the parameters for both /var/log/httpd/access.log and /var/log/httpd/error.log. They are rotated whenever they grow over 100k in size, and the old log files are mailed (uncompressed) to www@my.org after going through 5 rotations, rather than being removed. The shared scripts mean that the post-rotate script will only be run once, not once for each log that is rotated. Note that the double quotes around the first filename at the beginning of this section allow log rotate to rotate logs with spaces in the name. Normal shell quoting rules apply, with ', ", and \ characters supported.
The last section defines the parameters for all of the files in /var/log/news. Each file is rotated every month. This is considered a single rotation directive and if errors occur for more than one file, the log files are not compressed.
Please use wildcards with caution. If you specify *, log rotate will rotate all files, including previously rotated ones. A way around this is to use the olddir directive or a more exact wildcard (such as *.log).