Logrotate – Log files management tools is important to know

logrotate is a great utility for Linux to help simplify the management of log files on the system, including log file rotation, moving, compression, send automatic … Rotate (rotate round) here can be understood as the process of handling the old log file under the previous regulation (delete / compress / move) while creating a new log file.

By establishing strict but simple through configuration files, logrotate operate automatically, without manual intervention.

Log files are very important for administrators to monitor the status of system / application, however, if too many log files will cause the hard drive capacity is overloaded and cause difficulties in finding necessary information.

The log file of Canhme.com

HocVPS Script has automatically optimized log file with Nginx, PHP , MySQL so you do not need to worry about storage problems when used. Some other server control panel used frequently filled hard drive status, log files can be up to several GB.

1. Install logrotate

logrotate is installed by default on most Linux distributions. You can check with the command # logrotate with the response server version running on

 # logrotate
logrotate 3.8.7 - Copyright (C) 1995-2001 Red Hat, Inc.

If not installed, you update the system packages and install logrotate

On systems Ubuntu / Debian:

 # sudo apt-get update
# Sudo apt-get install logrotate

On systems CentOS / Redhat:

 # sudo yum update
# Sudo yum install logrotate

2. Configure logrotate

logrotate configuration is saved in /etc/logrotate.conf contains the entire set of information that logrotate managing log files, including iterative cycle, log file size, file compression …

 # see "man logrotate" for details
# Rotate log files weekly

# Keep 4 weeks worth of backlogs
rotate 4

# Create new (empty) log files after rotating old ones

# As a suffix use date of the rotated file

# Uncomment this if you want của log files compressed

# RPM packages drop log rotation information Into this directory
include /etc/logrotate.d

# No packages own wtmp and btmp - We'll rotate add here
/ Var / log / wtmp 
    create 0664 root utmp
        minsize 1M
    rotate 1

/ Var / log / btmp 
    create 0600 root utmp
    rotate 1

# System-specific logs lẽ be configured am also here.

According to the above, rotate log files weekly, log data is stored within 4 file, a new log file will be created after rotate old files. The log file suffix in the file name and date are compressed with gzip.

log file configuration information of each specific application are stored in /etc/logrotate.d/

For example, rotate log files configuration for MySQL /etc/logrotate.d/mysql

 / home / * / logs / mysql * .log 
        # Create 600 mysql mysql
        rotate 3
        maxage 7
        # Just if mysqld is really running
        if test -x / usr / bin / mysqladmin && / usr / bin / mysqladmin ping &> / dev / null
           / Usr / bin / mysqladmin flush-logs

Example configure Nginx rotate logfiles /etc/logrotate.d/nginx

 / home / * / logs / access.log /home/*/logs/error.log /home/*/logs/nginx_error.log 
        rotate 5
        maxage 7
        640 nginx create adm
                [ -f /var/run/nginx.pid ] && -USR1 kill `cat / var / run / nginx.pid`

can be seen, logrotate configuration is fairly simple structure consisting of only the log file path and set the following configuration in . Here I’ll go better than some common configuration options.

2.1. Log file selection rotate

You can specify one or more specific log file with the absolute path of the log file, the distinguished list of specific log file by spaces. For example:

 / home / * / logs / mysql * .log
/home/*/logs/access.log /home/*/logs/error.log /home/*/logs/nginx_error.log

2.2. Rotate over time

There are 4 configuration value corresponding to the time period will be rotate log files.

  • Daily: daily
  • Weekly: every week
  • Monthly: every first month
  • Yearly: every year

2.3. Rotate log files by size

We can specified process rotate based on file size, for example if it reaches capacity 100mb file, proceed rotate. The unit sizes can file using the K, M, G

 size 100k
size 100M
100G size

Configuration rotate based on file size is always a high priority based on time rather than rotate. Meanwhile, if 1 rotate log files according to the configuration specified file size, the time will be restarted rotate new.

For example, the log file is configured rotate weekly and weekly under 100mb space. However, by mid-week is rotate log files by file size reaches 100M. Meanwhile, logrotate will have to wait to next week to perform log rotate, rotate according to size by the always skipped this week’s time.

2.4. Log file handling drums

Parameters missingok : if for whatever reason the log file that is lost or does not exist * .log logrotate it will automatically move to the configuration log of other log files without having to output an error message. In contrast to the configuration nomissingok

Parameters Notifempty : do not rotate the log if the log file is empty.

2.5. Rotate log files by number of

 rotate [number]

Regulation number of old log files were retained after rotate. For example: rotate7 retain 7 old log files. Where have all the old log file, the file 7 oldest will be deleted to accommodate new log file is created.

2.6. Automatic log file compression

options Compress : logrotate will compress all the log file after it has been rotate, default by gzip.

If you want to use other compression programs such as bzip2, xz or zip, put that program into variable name after configuration values ​​ Compresscmd xz

Parameters Delaycompress will be useful in case you do not want to compress the old log files immediately after newly rotate. Instead, the job will be compressed later than by the delay will compress old log files rotate it to the next run. This option only works accompanied compress function in the configuration file, which you have to compress the previous configuration:


options nocompress does not use compression for the old log files

2.7. Log file decentralized

we can specify when logrotate has finished processing the old log file will create a new log file with the name corresponding to replace the current log file. Configuration parameters create shall determine the new log file created. You need to ensure compliance with the new decentralized after rotate log files.

Note: This activity will create the file before running the script postrotate. For example:

 create www-data APPUSER 660

new log file will have the owner’s APPUSER and under the group www-data (group which Apache normally runs). Powers 660 allows both owner and user in the first group allowed to write, edit content on the file. This allows PHP applications written in the log file.

If you do not want to automatically create a new log file, then use the option nocreate

Parameters dateext will help install log file name suffix is ​​the time structure yyyymmdd . Logs default file suffix values ​​are the numbers 1,2,3 …

2.8. Execute commands before or after rotate

logrotate can run commands before or after the process rotate. This usually applies to restart the service using log files in order not to interrupt the process of logging.

To run some rotate command before the process begins, we execute orders placed between prerotate and endscript . For example:

Touch /var/www/html/stop.txt

To run the command after the process ends rotate, we execute orders placed between postrotate and endscript . For example, the statement below, Apache will be restarted after the end logrotate.

/etc/init.d/apache2 reload> / dev / null

options sharedscripts postrotate Script will be run after all of the logs is rotate. Without this option, the script will be run postrotate after each log file rotate.

3. Check logrotate

logrotate After setup is complete, you save the system to automatically run in the setting.

3.1. Debug configuration logrotate

If you want to test the configuration is not standard, you use the parameter -d (debug) for separate logrotate configuration file. For example, check out the whole process of Nginx logrotate:

 -d /etc/logrotate.d/nginx logrotate
reading config file /etc/logrotate.d/nginx
reading config info for /home/*/logs/access.log /home/*/logs/error.log /home/*/logs/nginx_error.log

Handling 1 logs

rotating pattern: /home/*/logs/access.log /home/*/logs/error.log /home/*/logs/nginx_error.log after 1 hours (5 rotations)
empty log files are not rotated, old logs are removed
log considering /home/hocvps.com/logs/access.log
  does not need rotating log
log considering /home/hocvps.com/logs/error.log
  needs rotating log
log considering /home/hocvps.com/logs/nginx_error.log
  does not need rotating log
/home/hocvps.com/logs/error.log rotating log, log-> rotateCount is 5
dateext suffix '-20161216'
glob pattern '- [0-9] [0-9] [0-9] [0-9] [0-9] [0-9] [0-9] [0-9]'
/home/hocvps.com/logs/error.log.1 previous log does not exist
/home/hocvps.com/logs/error.log.5.gz renaming to /home/hocvps.com/logs/error.log.6.gz (rotateCount 5, logstart 1, i 5),
/home/hocvps.com/logs/error.log.4.gz renaming to /home/hocvps.com/logs/error.log.5.gz (rotateCount 5, logstart 1, i 4),
/home/hocvps.com/logs/error.log.3.gz renaming to /home/hocvps.com/logs/error.log.4.gz (rotateCount 5, logstart 1, i 3),
/home/hocvps.com/logs/error.log.2.gz renaming to /home/hocvps.com/logs/error.log.3.gz (rotateCount 5, logstart 1, i 2),
/home/hocvps.com/logs/error.log.1.gz renaming to /home/hocvps.com/logs/error.log.2.gz (rotateCount 5, logstart 1, i 1),
/home/hocvps.com/logs/error.log.0.gz renaming to /home/hocvps.com/logs/error.log.1.gz (rotateCount 5, logstart 1, i 0),
/home/hocvps.com/logs/error.log renaming to /home/hocvps.com/logs/error.log.1
/home/hocvps.com/logs/error.log new tạo uid = 498 mode = 0640 gid = 4
postrotate running script
running script with arg /home/*/logs/access.log /home/*/logs/nginx_error.log /home/*/logs/error.log "
                [ -f /var/run/nginx.pid ] && -USR1 kill `cat / var / run / nginx.pid`
Removing old log /home/hocvps.com/logs/error.log.6.gz
error: error opening /home/hocvps.com/logs/error.log.6.gz: No such file or directory

Output as on what errors do not appear, the standard configuration.

3.2. Running logrotate craft

In case you want to run right logrotate, use the command below:

 logrotate -vf /etc/logrotate.d/nginx


  • -v verbose display more information than normal, you want useful when debugging logrotate
  • -f mandatory rotate immediately
Logrotate – Log files management tools is important to know
5 (100%) 10 vote