Setting Up Log Rotation: A Step-by-Step Guide to Managing Syslogs

Logs are invaluable in system management, debugging, and security. However, if left unchecked, log files can consume all the available space on a system. This is where log rotation comes into play.

What is Log Rotation?

Log rotation is a system utility that efficiently manages log files. When activated, it renames and optionally compresses, deletes, or mails system log files once they reach a certain size or age.

Installing logrotate

For many systems, logrotate is the tool of choice. If it isn’t already installed on your system:

For Debian/Ubuntu:

sudo apt-get install logrotate

For CentOS/RedHat:

sudo yum install logrotate

Configuring logrotate

Configuration files for logrotate can typically be found at /etc/logrotate.conf and the files inside /etc/logrotate.d/.

A sample configuration for a log file might look like this:

/var/log/myapp/*.log {
    daily
    rotate 7
    compress
    delaycompress
    missingok
    notifempty
    create 0640 root adm
    postrotate
        /etc/init.d/myapp restart > /dev/null
    endscript
}

Breakdown:

• daily: Rotate logs every day.
• rotate 7: Keep only the last seven logs.
• compress: Compress (gzip by default) the rotated logs.
• delaycompress: Compress the log files from the previous rotation.
• missingok: Don’t throw an error if a log file is missing.
• notifempty: Don’t rotate the log if it’s empty.
• create: After rotation, create a new log file with specified permissions and ownership.
• postrotate…endscript: Specify commands to run post-rotation.

Rotating Syslogs

System logs, often found in /var/log/syslog or /var/log/messages, can be configured in a similar manner:

/var/log/syslog {
    daily
    missingok
    rotate 7
    compress
    delaycompress
    postrotate
        reload rsyslog >/dev/null 2>&1 || true
    endscript
}

Forcing Log Rotation

If you want to force logrotate to run regardless of its schedule, you can use:

sudo logrotate -f /etc/logrotate.conf

Testing Configuration

Before applying, it’s a wise practice to test the configuration:

sudo logrotate --debug /etc/logrotate.conf

Automation

By default, logrotate is set up as a daily cron job in /etc/cron.daily/logrotate. Ensure the cron daemon is running on your system to execute scheduled tasks.

Conclusion

A proper log rotation strategy is critical for maintaining a healthy system, preserving space, and ensuring crucial logs are not lost. With tools like logrotate, you can automate this process, ensuring efficient log management without manual intervention. Remember to frequently review your rotation settings to align with changing system and application behaviors.