Good evening!

If you have an application that is constantly writing to a log file, at some point this log may become huge. You may want to cut it and maybe even delete the chunks that are too old.

This is where logrotate comes in handy. It’s a script that is often preinstalled in popular Linux distributions. Bear in mind, logrotate is not a service or a daemon, it’s a script that is simply run on a daily basis by cron. By default, it is run in Ubuntu at 6:25AM every day, and is used to rotate (meaning, split) various system log files.

So I tried to create a config for my own log files. I simply needed to rotate all files in a certain folder on a daily basis and delete any logs that are older than 3 days. I encountered a number of problems, such as my program writing into a backup log instead of the actual one, among others. It took me a while until I figured out an acceptable recipe, so today I just want to share my findings. Consider it a quick cheat sheet.

So here’s the configuration file.

You can create it under any name in /etc/logrotate.d folder. It will rotate all files with .log extension in the /path/to/your/logs/ folder.

/path/to/your/logs/*.log
{
        daily
        missingok
        copytruncate
        rotate 2
        nomail
        dateext
        dateyesterday
        noolddir
}
  • daily - self-explanatory, means that a log needs to be rotated every day.
  • missingok - just in case you have no files that match your path; it will continue operation without error messages.
  • copytruncate - this one’s important if you have an app that works non-stop and keeps on writing to the log. Setting this option makes logrotate clean the original file and copy its contents to a backup file instead of simply renaming the original. If you have an app that runs non-stop and writes logs constantly, you may need this, or else your app will be writing to the backup file (which is simply the renamed original file) while the new file will be empty. That’s probably not what you want.

    Illustration of differences between using and not using copytruncate

    From the man page:

    Note that there is a very small time slice between copying the file and truncating it, so some logging data might be lost.

    In my case, this is not critical at all. But keep it in mind nevertheless.

  • rotate [number] - determines how many backup log files will be kept. In the example above, you will have log files for the two previous days along with the current one.
  • nomail - optional, if you don’t need backup logs to be emailed anywhere. If you want this functionality, take a look at mail, mailfirst and maillast.
  • dateext - adds a date at the end of the backup log file’s name. Very useful.
  • dateyesterday - since logs are rotated at about 6:25AM, the major part of the log file contains the data for the previous day. Setting this ensures that the date appended to the backup log file’s name will correspond to the previous day.
  • noolddir - optional, if you want the logs to remain in the folder where the original logs reside. If you want the opposite, take a look at the olddir option instead.

And that’s about it! Thanks for dropping by, and I’ll see you eventually.