Linux LOGROTATE usage


Logrotate provides an ability to systematically rotate and archive any log files produced by the system and thus reducing a operating system’s disk space requirement. By default logrotate is invoked once a day using a cron scheduler from location /etc/cron.daily/

# ls /etc/cron.daily/

cups logrotate makewhatis.cron mlocate.cron prelink readahead.cron rhsmd tmpwatch

Configuring Logrotate

Logrotate’s configuration is done by editing two separate configuration files:



service specific configuration files stored in /etc/logrotate.d/.

The main logrotate.conf file contains a generic configuration. Here is a default logrotate configuration file logrotate.conf:


1 weekly

2 rotate 4

3 create

4 dateext

5 include /etc/logrotate.d

6 /var/log/wtmp {

7 monthly

8 create 0664 root utmp

9 minsize 1M

10 rotate 1

11 }

Line 1 – weekly configuration option ensures a weekly rotation of all log-files defined in main configuration file and in /etc/logrotate.d/ directory.

Line 2 – rotate 4 ensures that logrotate keeps a 4 weeks backup of all log files

Line 3 – create option instructs logrotate to create new empty log files after each rotation

Line 4 – dateext appends an extension to all rotated log files in form of date when each particular log file was processed by logrotate

Line 5 – include all other configuration from directory /etc/logrotate.d

Line 6 – 11 contains a specific service log rotate configuration

As opposed to logrotate.conf a directory /etc/logrotate.d/ contains a specific service configuration files used by logrotate. In the next section we will create a sample skeleton logrotate configuration.

 Including new service logs to logrotate

In this section we will add new log file into a logrotate configuration. Let’s say that we have a log file called:



sitting in our /var/log directory that needs to be rotated on daily basis. First we need to create a new logrotate configuration file to accommodate for our new log file:


$ vi /etc/logrotate.d/linux

Insert a following text into /etc/logrotate.d/linuxcareer:



/var/log/linux.log {




size 20k


create 0600 root root


Here is a line by line explanation of the above logrotate configuration file:

TIP: If you wish to include multiple log files in a single configuration file use wildcard. For example /var/log/mylogs/*.log will instruct logrotate to rotate all log files located in /var/log/mylogs/ with extension .log.


missingok – do not output error if logfile is missing

notifempty – donot rotate log file if it is empty

compress – Old versions of log files are compressed with gzip(1) by default

size – Log file is rotated only if it grow bigger than 20k

daily – ensures daily rotation

create – creates a new log file wit permissions 600 where owner and group is root user

3.2. Testing a new Logrotate configuration

Once you have created a new logrotate configuration file within /etc/logrotate.d:


# cat /etc/logrotate.d/linux

/var/log/linux.log {




size 20k


create 0600 root root



create some sample log file ( if not existent ! ):


# echo “rotate my log file” > /var/log/linux.log

Once your log file is in place force logrotate to rotate all logs with -f option.

# logrotate -f /etc/logrotate.conf

Now visit again your /var/log/directory and confirm that your log file was rotated and new log file was created:


# cat /var/log/linux.log

rotate my log file

# logrotate -f /etc/logrotate.conf

# cat /var/log/linux.log

file /var/log/linuxcareer.log-20130409.gz

/var/log/linux.log-20130409.gz: gzip compressed data, from Unix, last modified: Tue Apr 9 12:43:50 2013

# zcat /var/log/linux.log-20130409.gz

rotate my log file

As you can see the new empty log file linux.log was created and old linux.log file was compressed with gzip and renamed with date extension.

In order to see a content of your compressed log file you do not need to decompress it first. Use zcat or zless commands which will decompress your log file on fly.




Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )


Connecting to %s