Getting started with logrotate

Log files are very useful for development, operation and maintenance. Through the log, you can track the use of the system and troubleshoot faults. However, in order to obtain more log information, the log file becomes large and requires more disk space. After the system runs for a period of time, the log file will grow uncontrollably. Disk usage aside, fat log files themselves can slow down your system. Therefore, log files should be kept within a controllable range. Effective management of log files is also an important task for operation and maintenance. The usual practice is to archive logs once a day.

Log rotation, log splitting, log rolling, log rotation, etc., all mean that the logs of the system are regularly archived, a new log record is opened, and the old log record is deleted.

There are many methods for log rotation, such as:
Apache: /usr/local/apache2/bin/rotatelogs
Framework: Log4j, Logback's RollingFileAppender, etc.

Linux itself provides a very useful logrotate function, which can automatically truncate, compress and delete old log files. The logrotate package is installed by default on mainstream Linux distributions. You can view the detailed usage of the command through man logrotate. It should be noted that logrotate itself is not a Demon and needs to be implemented with the help of crond.

(1) Related files
/usr/sbin/logrotate logrotate command
/etc/cron.daily/logrotate Execute logrotate through this shell every day
/etc/logrotate.conf The configuration file specified when executing the shell
/etc/logrotate.d/ This folder The log rolling configuration of each software is placed under it, such as httpd, yum, mysql

(2) Configure logrotate.conf

1) logrotate is a log file location definition rule

Single file definition
/tmp/output.log {
}

Multiple files are defined at the same time
/usr/local/nginx/logs/access.log /usr/local/nginx /logs/error.log {
}

wildcard definition
/usr/local/domain1.com/log/*log {
}

2) Rolling strategy

1 - file size For
example , when a file reaches 30k, start rolling the log file

/tmp/output .log {
    size 30k
    create 0600 root root
}

2-daily/weekly/monthly
For example, roll the log file every day

/tmp/output.log {
    daily
    create 0600 root root
}

3) Create a file
After the log file is archived, a new one needs to be created The file continues to record the log

1-create
create is to create a new file, but the general log file will be handled by the handler, so it cannot be newly created.

2-copytruncate
After copying the source file, empty the file content.
/tmp/output.log {
    daily
    copytruncate
}

4) Retain the number of files
Automatically clear old files, and retain certain required files
/tmp/output.log {
    daily
    create 0600 root root
    rotate 7
}
rotate is in units of numbers. maxage is in days. If the log is rotated in days, the two are the same.

5) The archive file extension

starts from number 1 by default
/tmp/output.log.1
/tmp/output.log.2 /tmp/output.log.3 date
/tmp/output.log {     daily     create 0600 root root     rotate 7     dateext } The default is /tmp/output.log-YYYYMMDD The following can set the date format to /tmp/output.log_YYYYMMDD











/tmp/output.log {
    daily
    create 0600 root root
    rotate 7
    dateext
    dateformat _%Y%m%d
}

6) Compressed archive
/tmp/output.log {
    daily
    create 0600 root root
    rotate 7
    dateext
    compress
} The
archive file is: / tmp/output.log-YYYYMMDD.gz

7) Execute shell (postrotate, sharedscripts) in the configuration file
/tmp/output.log {
    size 1k
    copytruncate
    rotate 4
    compress
    postrotate
      /home/rensanning/myscript.sh
    endscript
}

For multiple log files , in a configuration, the result is the same, using sharedscripts avoids the shell being executed multiple times.
logrotate checks whether the log file needs to be rotated before executing the postrotate script, and only executes the postrotate script once if necessary.
/home/demo/public_html/domain1.com/log/*log /home/demo/public_html/domain2.com/log/*log {
    rotate 14
    daily
    compress
    sharedscripts
    postrotate
        /usr/sbin/apachectl graceful > /dev/null
    endscript
}

8) No error is reported when the log file does not exist

/tmp/output.lo {
    size 1k
    missingok
}

(3) The archive status
logrotate will save the archive status information in the file logrotate.status, the default path is: /var/lib/logrotate. status

[root@localhost ~]# cat /var/lib/logrotate.status
logrotate state -- version 2
"/var/log/yum.log" 2018-1-1
"/var/log/httpd/*log" 2014-11-14
"/var/lib/mysql/mysqld.log" 2015-6-8
"/var/log/httpd/error_log" 2016-6-19
"/ var/log/httpd/access_log" 2016-6-19
"/var/log/cron" 2018-2-4 The

left quotation mark is the log file path, and the right date is the date of the latest rotation.
View this file to know the latest status of a log file. If there is a problem with NTP time synchronization, you can delete the line in the log file in question and re-rotate it.

(4) Execution options
are executed by default
# /usr/sbin/logrotate /tmp/log/logrotate.conf

main options
# /usr/sbin/logrotate -vdf /tmp/log/logrotate.conf
-v Display the details of the logrotate execution process Information
-d does not actually execute rotate, it is used to check whether the configuration is correct
-f is enforced, if you find that a log file that should be rotated does not have rotate, you can use this option to force rotate