Rotate, compress, and remove system logs
The logrotate command is used to rotate, compress, and remove system logs, and can also send logs to a specified email address. It simplifies the management of log files generated by the system. Each log file can be configured for daily, weekly, or monthly processing, or processed immediately when it exceeds a certain size. You must specify a configuration file; the default configuration file is located at /etc/logrotate.conf.
logrotate (options) (parameters)
-?, --help: Display help information;
-d, --debug: Enable debug mode, showing detailed execution steps for troubleshooting;
-f, --force: Force log rotation even if logrotate doesn't think it's necessary;
-s, --state=<state_file>: Use the specified state file;
-v, --verbose: Display verbose information during execution;
--usage: Display basic usage information.
Configuration file: Specify the configuration file for the logrotate command.
cron typically invokes logrotate via the script /etc/cron.daily/logrotate.
The main configuration file /etc/logrotate.conf usually includes configurations from the /etc/logrotate.d directory.
You can create a file with any suffix in /etc/logrotate.d to manage specific logs. For example:
/tmp/log/log.txt
{
copytruncate
daily
rotate 30
missingok
ifempty
compress
noolddir
}
This configuration means /tmp/log/log.txt will be rotated and compressed daily, keeping 30 backups.
Configuration Options:
compress: Compress rotated logs using gzip.nocompress: Do not compress logs.copytruncate: Used for logs that are still open; backs up the current log and then truncates it. Note that there's a small window where data might be lost.nocopytruncate: Back up the log file without truncating it.create mode owner group: Specify attributes for the new log file (e.g., create 0777 nobody nobody).nocreate: Do not create a new log file.delaycompress: Delay compression of the rotated log until the next rotation cycle.nodelaycompress: Compress the log immediately during rotation (overrides delaycompress).missingok: Continue to the next log without error if the current log is missing.errors address: Send error messages to the specified email address.ifempty: Rotate the log even if it is empty (default).notifempty: Do not rotate the log if it is empty.mail address: Send rotated logs to the specified email address.nomail: Do not email rotated logs.olddir directory: Move rotated logs to the specified directory (must be on the same filesystem).noolddir: Keep rotated logs in the same directory as the current log.sharedscripts: Run the postrotate script once after all logs matching a wildcard have been rotated.prerotate: Commands to execute before rotation (must be on separate lines).postrotate: Commands to execute after rotation (e.g., restarting a service like kill -HUP).daily, weekly, monthly: Specify the rotation interval.rotate count: Number of rotated logs to keep (0 means no backups).dateext: Use the current date as an extension for rotated logs.dateformat .%s: Define the date format for rotated logs (supports %Y %m %d %s; must be used with dateext).size (or minsize) log-size: Rotate only when the log reaches a certain size.If you use wildcards like this in /etc/logrotate.d:
/tmp/log/log*
{
...
}
Be careful, as this might cause already rotated logs to be rotated again if their filenames still match the pattern (e.g., log.txt.1).