Linux Log Rotation

in

You know what I’m talking about, right? Those ***** logs that fill up your hard drive like a toddler with candy.

First why do we need log rotation in the first place? Simple answer: space management. Logs can take up a lot of precious disk real estate and if left unchecked, they will eventually fill your entire drive. And let’s be honest here, nobody wants to deal with that kind of mess.

So how does log rotation work exactly? Well, it’s pretty simple really. You set up a system that automatically rotates old logs (compressed or otherwise) and creates new ones as needed. This way you can keep your logs for as long as you need them without worrying about running out of space.

Now the details. In Linux, log rotation is handled by a tool called ‘logrotate’. It’s installed on most distros by default and it’s pretty easy to set up. Here are some basic steps:

1. Create a new configuration file in /etc/logrotate.d/. This can be any name you like but make sure it has the .conf extension (e.g. myapp.conf).

2. Open your new config file and add the following lines:

#!/bin/bash

# This script is used to set up log rotation for a specific application.

# Create a new configuration file in /etc/logrotate.d/ with the .conf extension.
# Replace "myapp" with the name of your application.
# Example: myapp.conf
touch /etc/logrotate.d/myapp.conf

# Open the new config file and add the following lines:
# /var/log/myapp/*.log - specifies the log files to rotate
# weekly - rotates the logs on a weekly basis
# rotate 4 - keeps 4 rotated logs before deleting the oldest one
# compress - compresses the rotated logs
# delaycompress - delays compression until the next rotation cycle
# missingok - ignores missing log files
# notifempty - does not rotate empty log files
echo "/var/log/myapp/*.log {
    weekly
    rotate 4
    compress
    delaycompress
    missingok
    notifempty
}" >> /etc/logrotate.d/myapp.conf

# Save and close the config file. Log rotation is now set up for your application.

Let’s break this down:
– /var/log/myapp/*.log This is the directory and file pattern you want to apply log rotation to (in our case, it’s a specific application). You can add more patterns if needed.
– weekly Set up log rotation on a weekly basis.
– rotate 4 Keep four weeks worth of backlogs.
– compress Compress old logs for space management.
– delaycompress Delay compression until the next rotation cycle to save resources.
– missingok Ignore files that don’t exist (useful if you have temporary or one-time log files).
– notifempty Don’t rotate empty logs (saves time and space).

3. Save your config file and exit.

4. Restart the ‘logrotate’ service to apply changes:

# This script restarts the 'logrotate' service to apply changes made in the config file.

# Restart the 'logrotate' service using the systemctl command.
systemctl restart logrotate

And that’s it! Your new configuration will take effect on the next rotation cycle (usually once a week). You can also run ‘logrotate’ manually if you need to rotate logs immediately.

Now some advanced techniques for reading and filtering log files using grep, tail, and other tools. But that’s a topic for another day!

SICORPS