Easy Log Rotation with Logrotate On Ubuntu

Sysadmin

You don’t need to write your own log rotation service in Linux, you can use the built in service called logrotate super easily.

Below is a directory listing inside a common /etc/logrotate dir. There are already be a bunch of existing services using logrotate already. Peak around them for examples if you’d like.

root@util:/etc/logrotate.d# ll
total 100
drwxr-xr-x   2 root root  4096 Dec 15 09:50 ./
drwxr-xr-x 174 root root 12288 Dec 27 18:02 ../
-rw-r--r--   1 root root   434 Mar 10  2015 apache2
-rw-r--r--   1 root root   126 Mar 17  2015 apport
-rw-r--r--   1 root root   173 Apr 10  2014 apt
-rw-r--r--   1 root root    79 Feb 17  2014 aptitude
-rw-r--r--   1 root root   413 Dec 11  2015 cups-daemon
-rw-r--r--   1 root root   232 Mar  7  2014 dpkg
-rw-r--r--   1 root root   197 Dec 15  2015 haproxy
-rw-r--r--   1 root root   609 Jan  8  2015 landscape-client
-rw-r--r--   1 root root   686 Jun 23  2016 mysql-server
-rw-r--r--   1 root root   157 Feb 16  2016 pm-utils
-rw-r--r--   1 root root    94 Nov 25  2014 ppp
-rw-r--r--   1 root root   260 Mar  5  2014 rabbitmq-server
-rw-r--r--   1 root root   515 Dec  4  2013 rsyslog
-rw-r--r--   1 root root   513 Feb 19  2014 speech-dispatcher
-rw-r--r--   1 root root   339 Jun  8  2016 squid3
-rw-r--r--   1 root root   178 Feb 28  2014 ufw
-rw-r--r--   1 root root   177 Dec  6  2013 unattended-upgrades
-rw-r--r--   1 root root   122 Apr 11  2014 upstart

Create a script in logrotate.d folder

Open up a new file in the /etc/logrotate.d directory, you can name it whatever you want, as long as there isn’t an existing file with the same name.

vi /etc/logrotate.d/mycustomservice

Contents of Basic mycustomservice Log Rotator

The log file name goes at the very top of the script, in this case /var/log/mycustomservice.log, followed by the params.

/var/log/mycustomservice.log
{
        rotate 4
        daily
        missingok
        notifempty
        compress
        delaycompress
        sharedscripts
        postrotate
        endscript
}

That’s all there is to making your custom log rotator.

List of common Log Rotate params and their descriptions

See man page for more options.

param description
compress Old versions of log files are compressed with gzip(1) by default. See also nocompress.
daily Log files are rotated every day.
missingok If the log file is missing, go on to the next one without issuing an error message. See also nomissingok.
notifempty Do not rotate the log if it is empty (this overrides the ifempty option).
rotate count Log files are rotated count times before being removed or mailed to the address specified in a mail directive. If count is 0, old versions are removed rather than rotated.
size size Log files are rotated only if they grow bigger then size bytes. If size is followed by k, the size is assumed to be in kilobytes. If the M is used, the size is in megabytes, and if G is used, the size is in gigabytes. So size 100, size 100k, size 100M and size 100G are all valid.
delaycompress Postpone compression of the previous log file to the next rotation cycle. This only has effect when used in combination with compress. It can be used when some program cannot be told to close its logfile and thus might continue writing to the previous log file for some time.
postrotate/endscript The lines between postrotate and endscript (both of which must appear on lines by themselves) are executed (using /bin/sh) after the log file is rotated. These directives may only appear inside a log file definition.
Normally, the absolute path to the log file is passed as first argument to the script. If sharedscripts is specified, whole pattern is passed to the script. See also prerotate. See sharedscripts and nosharedscripts
for error handling.
sharedscripts Normally, prerotate and postrotate scripts are run for each log which is rotated and the absolute path to the log file is passed as first argument to the script. That means a single script may be run multiple times for
log file entries which match multiple files (such as the /var/log/news/* example). If sharedscripts is specified, the scripts are only run once, no matter how many logs match the wildcarded pattern, and whole pattern
is passed to them. However, if none of the logs in the pattern require rotating, the scripts will not be run at all. If the scripts exit with error, the remaining actions will not be executed for any logs. This option
overrides the nosharedscripts option and implies create option.