logrotate [-d|--debug] [-v|--verbose] [-f|--force] [-s|--state file] [config_file …]
Example:
sudo service rsyslog restart #†
sudo logrotate -v /etc/logrotate.d/rsyslog 2>&1 | sed --unbuffered '/Creating new state/d' |more
service rsyslog status|tail -n 10
syslog
subsystem. logrotate
manages logs by providing rotation, compression,
removal and mailing of log files.
Run as a cron job,
Config files MUST have mode rw-r--r--
!
Normally, a single "master" config file includes other config files .
Multiple config files may be given on the command line, later options override.
A directory on the command line, causes all files in that directory to be used.
-d |
weekly … su root staff
) is not permitted.
Lines before the first filename set global options.
Local definitions override global ones and later definitions override earlier ones and specify logfiles to rotate. N.B. Specifying a specific config files will not use global options from "master" config file.
# global options effect all files compress maxsize 100000 ##### /var/log/messages { rotate 5 weekly postrotate /usr/bin/killall -HUP syslogd endscript } "/var/log/httpd/access.log" /var/log/httpd/error.log { rotate 5 mail wwwadmin@my.org size 100k sharedscripts postrotate /usr/bin/killall -HUP httpd endscript } /var/log/news/* { monthly rotate 2 olddir /var/log/news/old missingok postrotate kill -HUP `cat /var/run/inn.pid` endscript nocompress }Explaination:
#
begins a comment.
/var/log/messages
will go through five weekly rotations (a month plus 1 week).
After it has been rotated (but before the old version has been compressed),
/sbin/killall -HUP syslogd
will be executed to wake up syslogd
and get it to look around.
Both /var/log/httpd/access.log
and /var/log/httpd/error.log
are rotated when it grows over 100k in size,
the old logs files are mailed (uncompressed!) to wwwadmin@my.org
after going through 5 rotations, rather than being removed.
With sharedscripts the postrotate script will only be run once (after the old logs have been compressed), not for each log.
Names may need to be enclosed in quotes
All files in /var/log/news
are rotated on a monthly basis.
This is a single rotation directive and if errors occur for more than one file, the logs are not compressed.
If the directory /var/log/news
does not exist, an error is reported which is not stopped with the missingok
.
Use wildcards with caution. Specifingy *, will rotate all files, including previously rotated ones.
Use olddir
or a more exact wildcard (such as *.log).
[no]compress | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
[no]create mode owner group |
Immediately after rotation (before postrotate ) new file is created numeric mode for the file (as chmod ).Defaults to the same values as the original Disabled with nocreate . Does not create files not rotated ex missing.
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
[no]copy |
sudo logrotate -dv /etc/logrotate.d
/var/lib/logrotate.status
Default state file./etc/logrotate.conf
Configuration options.
/var/lib/logrotate/status
dapie 9/24/13
logrotate state -- version 2 "/var/log/ConsoleKit/history" 2013-3-1 "/var/log/syslog" 2013-3-10 "/var/log/dpkg.log" 2013-7-10 "/var/log/auth.log" 2013-9-22 "/var/log/apt/term.log" 2013-3-1 "/var/log/mysql/mysql-slow.log" 2013-3-14 "/var/log/apt/history.log" 2013-3-1 "/var/log/samba/log.smbd" 2013-3-3 "/var/log/alternatives.log" 2013-7-10 "/var/log/debug" 2013-1-13 "/var/log/mail.log" 2013-1-6 "/var/log/kern.log" 2013-9-22 "/var/log/mysql.log" 2013-9-24 "/var/log/aptitude" 2013-1-6 "/var/log/apache2/access.log" 2013-3-14 "/var/log/wtmp" 2013-9-1 "/var/log/daemon.log" 2013-9-22 "/var/log/mail.warn" 2013-1-6 "/var/log/xdm.log" 2013-9-1 "/var/log/btmp" 2013-9-1 "/var/log/lpr.log" 2013-1-6 "/var/log/mail.err" 2013-1-6 "/var/log/mysql/mysql.log" 2013-3-14 "/var/log/samba/log.nmbd" 2013-3-6 "/var/log/user.log" 2013-9-22 "/var/log/mail.info" 2013-1-6 "/var/log/apache2/other_vhosts_access.log" 2013-3-14 "/var/log/apache2/error.log" 2013-3-14 "/var/log/cron.log" 2013-1-6 "/var/log/messages" 2013-1-13sample output