Lots of daemons running in CentOS Linux create their own log files. These log files contain helpful messages pertaining to the operation of those daemons. For example error messages that help in diagnosing problems with the system. Over time these log files have to be rotated so that they are easier to manage. Log rotation is the process of splitting large log files and archiving old log files for future reference. In CentOS a program called logrotate is responsible for rotating log files. In this post I look at how to customize the operation of logrotate.

Running logrotate

logrotate is run daily by cron via the file /etc/cron.daily/logrotate. In CentOS 5.x cron is responsible for running system cron jobs like logrotate. It can be configured by editing /etc/crontab.

In CentOS 6.x anacron is installed by default and is responsible for running system cron jobs.

logrotate.conf

logrotate.conf is located in /etc/ and holds the default system wide configuration for logrotate. By default on CentOS logrotate will rotate logs weekly and maintain 4 weeks of backlogs. You can customize logrotate.conf but it is usually better to customize the individual daemon’s log rotation configuration in /etc/logrotate.d/

/etc/logrotate.d/

This directory contains log rotation files for different services running on the system.

A typical file in this directory is this one for Apache ( /etc/logrotate.d/httpd ):

/var/log/httpd/*log {
    missingok
    monthly
    notifempty
    sharedscripts
    postrotate
        /sbin/service httpd reload > /dev/null 2> /dev/null || true
    endscript
}

The first line is a regular expression that matches the log files. In this case all files ending in “log” and residing in the /var/log/httpd directory.

Then inside the opening and closing braces you have the options for log rotation for this daemon’s files. In the above case you have monthly rotation configured.

Options for logrotate

Some of the options that you can include in the logrotate.conf file or the individual daemon’s log rotation files in /etc/logrotate.d/ are :

• rotate: Specify the number of back logs to keep using the rotate option. For example “rotate 5” will keep 5 old log files.
• compress: Will compress the old log files to save disk space.
• daily, weekly, monthly or yearly: Rotate logs after the specified period has passed.
• size: Specify the size of the log file to trigger rotation. For example “size 50M” will rotate the log file if it is 50MB or greater in size. You can use the prefix M for megabytes, k for kilobytes and G for gigabytes. If no prefix is used it will take it to mean bytes.
• minsize: This is like size except it also takes into account the period ( monthly, weekly etc. ). So it will only rotate the log files if the period is reached AND the log files are larger than the minsize specified.
• prerotate and postrotate: These specify commands that you can run before and after log rotation. For example restarting the daemon after log rotation.

For the full list of available options see the logrotate.conf man file ( man logrotate.conf  on CentOS ).