logrotate - rotates, compresses, and mails system logs

logrotate

Flags :

Flag Usage
-d debug mode : (implies -v : verbose mode) no changes will be made to the logs or to the state file
-f
force log rotation :
/usr/sbin/logrotate -f /etc/logrotate.d/serviceName; echo $?
If things don't work as expected (and since logrotate generates no logs), try this again with -d to view error messages :
/usr/sbin/logrotate -df /etc/logrotate.d/serviceName 2>&1 | grep error
with -d, log rotation is simulated.

Configuration directives :

Directive Usage
compresscmd /bin/bzip2 Compress logs with /bin/bzip2 instead of the default gzip.
Should be used with compressext, otherwise compressed files get a .gz extension.
compressext .bz2 Give compressed files a .bz2 extension
dateext When rotating logs, instead of appending numbers to successive rotations (from 1 (newest) to n (oldest)), append the log rotation date (default format : YYYYMMDD)
While rotated logs are re-numbered at each rotation, logs with dates are not renamed.

Usage :

To rotate logs (or any kind of file, such as .tar backups), you just have to :
  1. Create a new /etc/logrotate.d/serviceName configuration file
  2. Then edit it like :
    /path/to/serviceName/*log {
    	# Rotate logs on a ... basis
    	daily
    
    	# Keep n old log files (i.e. n days back with daily rotation)
    	rotate 10
    
    	# compress rotated logs
    	compress
    
    	# Immediately after rotation, create a new empty log file with :
    	# - same name than rotated file
    	# - [mode] [owner] [group] as specified below
    	create 644 userName groupName
    
    	# Don't issue an error if the log file is missing
    	missingok
    
    	# Store rotated logs into :
    	olddir /path/to/serviceName/rotatedLogs
    	}
    • you can list several patterns sharing the same log rotation specification :
      /var/log/tomcat8/catalina.out /var/log/tomcat8/*log {
      	...
      	}
    • patterns like /var/log/tomcat8/*/*log are also supported
  3. Save and exit. Nothing to restart / reload

logrotate itself is fired by cron :

find /etc/cron* -name logrotate
/etc/cron.d/logrotate
/etc/cron.daily/logrotate

Rotation intervals / conditions (source) :

daily
Each rotated file is listed in the state file (/var/lib/logrotate.status) with the date of its latest rotation. If current date > date in state file, the file is rotated (source).
weekly
logs are rotated if the current week day is lower than the week day of the last rotation (i.e. Monday is less than Friday) or if the last rotation occurred more than a week before the present
monthly
logs are rotated every month on the first day of the month that logrotate runs, which is often the first day of the month
yearly
logs are rotated when the current year differs from the date of the last rotation
size
logs are rotated based on their size rather than on a periodic schedule : size n[kMG]

Latest round (source) :

The date of the latest rotation can be found with :
grep serviceName /var/lib/logrotate/status
Looks like the 1st rotation must wait at least 24 hours before being processed.