Most of services and daemons running in CentOS (Linux) are creating their own log files. These log files have necessary notifications and messages related to those services and daemons. You can access logs for any specific messages that will help to find and locate system problems. So we have the priority task to rotate these files and avoid eating much disk space.
Log rotation is the process of splitting large log files and archiving old log files for future reference. In CentOS 7 a program called ‘logrotate’ which is responsible for rotating log files. In this article we will take a deep look inside the ‘logrotate’ operations.
Log rotating configuration
The logrotate program can be used to automate the log file rotation. The basic logrotate configuration is done in the configuration file /etc/logrotate.conf. In the configuration file we can set options such as – how frequently logs should be rotated and how many old logs to be kept.
logrotate.conf holds the default system wide configuration for logrotate. By default on CentOS logrotate will rotate logs weekly and maintain 4 weeks of backlogs.
# cat /etc/logrotate.conf
weekly
rotate 4
create
include /etc/logrotate.d
/var/log/wtmp {
monthly
minsize 1M
create 0664 root utmp
rotate 1
}
Logrotate configuration:
- minsize 1M – logrotate runs and trims the messages files if the file size is equal to or greater than 1 MB.
- rotate 4 – keep the most recent 4 files while rotating.
- create – create new file while rotating with specified permission and ownership.
- include – include the files mentioned here for the daemon specific log rotation settings.
You can customize logrotate.conf but it is usually better to customize the individual daemon’s log rotation configuration in /etc/logrotate.d/
Log rotation daemon
Let’s see how log rotation daemon works:
- The logrotate daemon mainly reads all the configuration from file /etc/logrotate.conf and then includes daemon specific configuration files from /etc/logrotate.d/ directory.
- The logrotate daemon along with rotation and removal of old logs, allows compression of log files.
- The daemon runs daily from /etc/cron.daily/logrotate.