1LOGROTATE(8) System Administrator's Manual LOGROTATE(8)
2
6 logrotate ‐ rotates, compresses, and mails system logs
7
9 logrotate [-dv] [-f|--force] [-s|--state file] config_file ..
10
12 logrotate is designed to ease administration of systems that generate
13 large numbers of log files. It allows automatic rotation, compression,
14 removal, and mailing of log files. Each log file may be handled daily,
15 weekly, monthly, or when it grows too large.
16 Normally, logrotate is run as a daily cron job. It will not modify a
18 log more than once in one day unless the criterion for that log is
19 based on the log's size and logrotate is being run more than once each
20 day, or unless the -f or --force option is used.
21 Any number of config files may be given on the command line. Later con‐
23 fig files may override the options given in earlier files, so the order
24 in which the logrotate config files are listed is important. Normally,
25 a single config file which includes any other config files which are
26 needed should be used. See below for more information on how to use
27 the include directive to accomplish this. If a directory is given on
28 the command line, every file in that directory is used as a config
29 file.
30 If no command line arguments are given, logrotate will print version
32 and copyright information, along with a short usage summary. If any
33 errors occur while rotating logs, logrotate will exit with non-zero
34 status.
35
38 -?, --help
39 Prints help message.
40 -d, --debug
43 Turns on debug mode and implies -v. In debug mode, no changes
44 will be made to the logs or to the logrotate state file.
45 -f, --force
48 Tells logrotate to force the rotation, even if it doesn't think
49 this is necessary. Sometimes this is useful after adding new
50 entries to a logrotate config file, or if old log files have
51 been removed by hand, as the new files will be created, and log‐
52 ging will continue correctly.
53 -m, --mail <command>
56 Tells logrotate which command to use when mailing logs. This
57 command should accept two arguments: 1) the subject of the mes‐
58 sage, and 2) the recipient. The command must then read a message
59 on standard input and mail it to the recipient. The default mail
60 command is /bin/mail -s.
61 -s, --state <statefile>
64 Tells logrotate to use an alternate state file. This is useful
65 if logrotate is being run as a different user for various sets
66 of log files. The default state file is /var/lib/logro‐
67 tate/logrotate.status.
68 --usage
71 Prints a short usage message.
72 +-v, --verbose
75 Turns on verbose mode, ie. display messages during rotation.
76
79 logrotate reads everything about the log files it should be handling
80 from the series of configuration files specified on the command line.
81 Each configuration file can set global options (local definitions over‐
82 ride global ones, and later definitions override earlier ones) and
83 specify logfiles to rotate. A simple configuration file looks like
84 this:
85 # sample logrotate configuration file
87 compress
88 /var/log/messages {
90 rotate 5
91 weekly
92 postrotate
93 /usr/bin/killall -HUP syslogd
94 endscript
95 }
96 "/var/log/httpd/access.log" /var/log/httpd/error.log {
98 rotate 5
99 mail www@my.org
100 size 100k
101 sharedscripts
102 postrotate
103 /usr/bin/killall -HUP httpd
104 endscript
105 }
106 /var/log/news/* {
108 monthly
109 rotate 2
110 olddir /var/log/news/old
111 missingok
112 postrotate
113 kill -HUP `cat /var/run/inn.pid`
114 endscript
115 nocompress
116 }
117 ~/log/*.log {}
119 The first few lines set global options; in the example, logs are com‐
123 pressed after they are rotated. Note that comments may appear anywhere
124 in the config file as long as the first non-whitespace character on the
125 line is a #.
126 The next section of the config file defines how to handle the log file
128 /var/log/messages. The log will go through five weekly rotations before
129 being removed. After the log file has been rotated (but before the old
130 version of the log has been compressed), the command /sbin/killall -HUP
131 syslogd will be executed.
132 The next section defines the parameters for both
134 /var/log/httpd/access.log and /var/log/httpd/error.log. Each is
135 rotated whenever it grows over 100k in size, and the old logs files are
136 mailed (uncompressed) to www@my.org after going through 5 rotations,
137 rather than being removed. The sharedscripts means that the postrotate
138 script will only be run once (after the old logs have been compressed),
139 not once for each log which is rotated. Note that log file names may
140 be enclosed in quotes (and that quotes are required if the name con‐
141 tains spaces). Normal shell quoting rules apply, with ', ", and \
142 characters supported.
143 The next section defines the parameters for all of the files in
145 /var/log/news. Each file is rotated on a monthly basis. This is con‐
146 sidered a single rotation directive and if errors occur for more than
147 one file, the log files are not compressed.
148 The last section uses tilde expansion to rotate log files in the home
150 directory of the current user. This is only available, if your glob
151 library supports tilde expansion. GNU glob does support this.
152 Please use wildcards with caution. If you specify *, logrotate will
154 rotate all files, including previously rotated ones. A way around this
155 is to use the olddir directive or a more exact wildcard (such as
156 *.log).
157 Here is more information on the directives which may be included in a
159 logrotate configuration file:
160 compress
163 Old versions of log files are compressed with gzip(1) by
164 default. See also nocompress.
165 compresscmd
168 Specifies which command to use to compress log files. The
169 default is gzip(1). See also compress.
170 uncompresscmd
173 Specifies which command to use to uncompress log files. The
174 default is gunzip(1).
175 compressext
178 Specifies which extension to use on compressed logfiles, if com‐
179 pression is enabled. The default follows that of the configured
180 compression command.
181 compressoptions
184 Command line options may be passed to the compression program,
185 if one is in use. The default, for gzip(1), is "-6" (biased
186 towards high compression at the expense of speed). If you use a
187 different compression command, you may need to change the com‐
188 pressoptions to match.
189 copy Make a copy of the log file, but don't change the original at
193 all. This option can be used, for instance, to make a snapshot
194 of the current log file, or when some other utility needs to
195 truncate or parse the file. When this option is used, the cre‐
196 ate option will have no effect, as the old log file stays in
197 place.
198 copytruncate
201 Truncate the original log file to zero size in place after cre‐
202 ating a copy, instead of moving the old log file and optionally
203 creating a new one. It can be used when some program cannot be
204 told to close its logfile and thus might continue writing
205 (appending) to the previous log file forever. Note that there
206 is a very small time slice between copying the file and truncat‐
207 ing it, so some logging data might be lost. When this option is
208 used, the create option will have no effect, as the old log file
209 stays in place.
210 create mode owner group, create owner group
213 Immediately after rotation (before the postrotate script is run)
214 the log file is created (with the same name as the log file just
215 rotated). mode specifies the mode for the log file in octal
216 (the same as chmod(2)), owner specifies the user name who will
217 own the log file, and group specifies the group the log file
218 will belong to. Any of the log file attributes may be omitted,
219 in which case those attributes for the new file will use the
220 same values as the original log file for the omitted attributes.
221 This option can be disabled using the nocreate option.
222 createolddir mode owner group
225 If the directory specified by olddir directive does not exist,
226 it is created. mode specifies the mode for the olddir directory
227 in octal (the same as chmod(2)), owner specifies the user name
228 who will own the olddir directory, and group specifies the group
229 the olddir directory will belong to. This option can be disabled
230 using the nocreateolddir option.
231 daily Log files are rotated every day.
235 dateext
238 Archive old versions of log files adding a date extension like
239 YYYYMMDD instead of simply adding a number. The extension may be
240 configured using the dateformat and dateyesterday options.
241 dateformat format_string
244 Specify the extension for dateext using the notation similar to
245 strftime(3) function. Only %Y %m %d %H and %s specifiers are
246 allowed. The default value is -%Y%m%d except hourly, which uses
247 -%Y%m%d%H as default value. Note that also the character sepa‐
248 rating log name from the extension is part of the dateformat
249 string. The system clock must be set past Sep 9th 2001 for %s to
250 work correctly. Note that the datestamps generated by this for‐
251 mat must be lexically sortable (i.e., first the year, then the
252 month then the day. e.g., 2001/12/01 is ok, but 01/12/2001 is
253 not, since 01/11/2002 would sort lower while it is later). This
254 is because when using the rotate option, logrotate sorts all
255 rotated filenames to find out which logfiles are older and
256 should be removed.
257 dateyesterday
260 Use yesterday's instead of today's date to create the dateext
261 extension, so that the rotated log file has a date in its name
262 that is the same as the timestamps within it.
263 delaycompress
266 Postpone compression of the previous log file to the next rota‐
267 tion cycle. This only has effect when used in combination with
268 compress. It can be used when some program cannot be told to
269 close its logfile and thus might continue writing to the previ‐
270 ous log file for some time.
271 extension ext
274 Log files with ext extension can keep it after the rotation. If
275 compression is used, the compression extension (normally .gz)
276 appears after ext. For example you have a logfile named
277 mylog.foo and want to rotate it to mylog.1.foo.gz instead of
278 mylog.foo.1.gz.
279 hourly Log files are rotated every hour. Note that usually logrotate is
282 configured to be run by cron daily. You have to change this con‐
283 figuration and run logrotate hourly to be able to really rotate
284 logs hourly.
285 ifempty
288 Rotate the log file even if it is empty, overriding the
289 notifempty option (ifempty is the default).
290 include file_or_directory
293 Reads the file given as an argument as if it was included inline
294 where the include directive appears. If a directory is given,
295 most of the files in that directory are read in alphabetic order
296 before processing of the including file continues. The only
297 files which are ignored are files which are not regular files
298 (such as directories and named pipes) and files whose names end
299 with one of the taboo extensions, as specified by the tabooext
300 directive.
301 mail address
304 When a log is rotated out of existence, it is mailed to address.
305 If no mail should be generated by a particular log, the nomail
306 directive may be used.
307 mailfirst
310 When using the mail command, mail the just-rotated file, instead
311 of the about-to-expire file.
312 maillast
315 When using the mail command, mail the about-to-expire file,
316 instead of the just-rotated file (this is the default).
317 maxage count
320 Remove rotated logs older than <count> days. The age is only
321 checked if the logfile is to be rotated. The files are mailed to
322 the configured address if maillast and mail are configured.
323 maxsize size
326 Log files are rotated when they grow bigger than size bytes even
327 before the additionally specified time interval (daily, weekly,
328 monthly, or yearly). The related size option is similar except
329 that it is mutually exclusive with the time interval options,
330 and it causes log files to be rotated without regard for the
331 last rotation time. When maxsize is used, both the size and
332 timestamp of a log file are considered.
333 minsize size
336 Log files are rotated when they grow bigger than size bytes, but
337 not before the additionally specified time interval (daily,
338 weekly, monthly, or yearly). The related size option is similar
339 except that it is mutually exclusive with the time interval
340 options, and it causes log files to be rotated without regard
341 for the last rotation time. When minsize is used, both the size
342 and timestamp of a log file are considered.
343 missingok
346 If the log file is missing, go on to the next one without issu‐
347 ing an error message. See also nomissingok.
348 monthly
351 Log files are rotated the first time logrotate is run in a month
352 (this is normally on the first day of the month).
353 nocompress
356 Old versions of log files are not compressed. See also compress.
357 nocopy Do not copy the original log file and leave it in place. (this
360 overrides the copy option).
361 nocopytruncate
364 Do not truncate the original log file in place after creating a
365 copy (this overrides the copytruncate option).
366 nocreate
369 New log files are not created (this overrides the create
370 option).
371 nocreateolddir
374 olddir directory is not created by logrotate when it does not
375 exist.
376 nodelaycompress
379 Do not postpone compression of the previous log file to the next
380 rotation cycle (this overrides the delaycompress option).
381 nodateext
384 Do not archive old versions of log files with date extension
385 (this overrides the dateext option).
386 nomail Do not mail old log files to any address.
389 nomissingok
392 If a log file does not exist, issue an error. This is the
393 default.
394 noolddir
397 Logs are rotated in the directory they normally reside in (this
398 overrides the olddir option).
399 nosharedscripts
402 Run prerotate and postrotate scripts for every log file which is
403 rotated (this is the default, and overrides the sharedscripts
404 option). The absolute path to the log file is passed as first
405 argument to the script. If the scripts exit with error, the
406 remaining actions will not be executed for the affected log
407 only.
408 noshred
411 Do not use shred when deleting old log files. See also shred.
412 notifempty
415 Do not rotate the log if it is empty (this overrides the ifempty
416 option).
417 olddir directory
420 Logs are moved into directory for rotation. The directory must
421 be on the same physical device as the log file being rotated,
422 unless copy, copytruncate or renamecopy option is used. The
423 directory is assumed to be relative to the directory holding the
424 log file unless an absolute path name is specified. When this
425 option is used all old versions of the log end up in directory.
426 This option may be overridden by the noolddir option.
427 postrotate/endscript
430 The lines between postrotate and endscript (both of which must
431 appear on lines by themselves) are executed (using /bin/sh)
432 after the log file is rotated. These directives may only appear
433 inside a log file definition. Normally, the absolute path to the
434 log file is passed as first argument to the script. If shared‐
435 scripts is specified, whole pattern is passed to the script.
436 See also prerotate. See sharedscripts and nosharedscripts for
437 error handling.
438 prerotate/endscript
441 The lines between prerotate and endscript (both of which must
442 appear on lines by themselves) are executed (using /bin/sh)
443 before the log file is rotated and only if the log will actually
444 be rotated. These directives may only appear inside a log file
445 definition. Normally, the absolute path to the log file is
446 passed as first argument to the script. If sharedscripts is
447 specified, whole pattern is passed to the script. See also
448 postrotate. See sharedscripts and nosharedscripts for error
449 handling.
450 firstaction/endscript
453 The lines between firstaction and endscript (both of which must
454 appear on lines by themselves) are executed (using /bin/sh) once
455 before all log files that match the wildcarded pattern are
456 rotated, before prerotate script is run and only if at least one
457 log will actually be rotated. These directives may only appear
458 inside a log file definition. Whole pattern is passed to the
459 script as first argument. If the script exits with error, no
460 further processing is done. See also lastaction.
461 lastaction/endscript
464 The lines between lastaction and endscript (both of which must
465 appear on lines by themselves) are executed (using /bin/sh) once
466 after all log files that match the wildcarded pattern are
467 rotated, after postrotate script is run and only if at least one
468 log is rotated. These directives may only appear inside a log
469 file definition. Whole pattern is passed to the script as first
470 argument. If the script exits with error, just an error message
471 is shown (as this is the last action). See also firstaction.
472 preremove/endscript
475 The lines between preremove and endscript (both of which must
476 appear on lines by themselves) are executed (using /bin/sh) once
477 just before removal of a log file. The logrotate will pass the
478 name of file which is soon to be removed. See also firstaction.
479 rotate count
482 Log files are rotated count times before being removed or mailed
483 to the address specified in a mail directive. If count is 0, old
484 versions are removed rather than rotated.
485 size size
488 Log files are rotated only if they grow bigger then size bytes.
489 If size is followed by k, the size is assumed to be in kilo‐
490 bytes. If the M is used, the size is in megabytes, and if G is
491 used, the size is in gigabytes. So size 100, size 100k, size
492 100M and size 100G are all valid.
493 sharedscripts
496 Normally, prerotate and postrotate scripts are run for each log
497 which is rotated and the absolute path to the log file is passed
498 as first argument to the script. That means a single script may
499 be run multiple times for log file entries which match multiple
500 files (such as the /var/log/news/* example). If sharedscripts is
501 specified, the scripts are only run once, no matter how many
502 logs match the wildcarded pattern, and whole pattern is passed
503 to them. However, if none of the logs in the pattern require
504 rotating, the scripts will not be run at all. If the scripts
505 exit with error, the remaining actions will not be executed for
506 any logs. This option overrides the nosharedscripts option and
507 implies create option.
508 shred Delete log files using shred -u instead of unlink(). This
511 should ensure that logs are not readable after their scheduled
512 deletion; this is off by default. See also noshred.
513 shredcycles count
516 Asks GNU shred(1) to overwrite log files count times before
517 deletion. Without this option, shred's default will be used.
518 start count
521 This is the number to use as the base for rotation. For example,
522 if you specify 0, the logs will be created with a .0 extension
523 as they are rotated from the original log files. If you specify
524 9, log files will be created with a .9, skipping 0-8. Files
525 will still be rotated the number of times specified with the
526 rotate directive.
527 su user group
530 Rotate log files set under this user and group instead of using
531 default user/group (usually root). user specifies the user name
532 used for rotation and group specifies the group used for rota‐
533 tion. If the user/group you specify here does not have suffi‐
534 cient privilege to make files with the ownership you've speci‐
535 fied in a create instruction, it will cause an error.
536 tabooext [+] list
539 The current taboo extension list is changed (see the include
540 directive for information on the taboo extensions). If a + pre‐
541 cedes the list of extensions, the current taboo extension list
542 is augmented, otherwise it is replaced. At startup, the taboo
543 extension list contains .rpmsave, .rpmorig, ~, .disabled,
544 .dpkg-old, .dpkg-dist, .dpkg-new, .cfsaved, .ucf-old, .ucf-dist,
545 .ucf-new, .rpmnew, .swp, .cfsaved, .rhn-cfg-tmp-*
546 weekly [weekday]
549 Log files are rotated once each weekday, or if the date is
550 advanced by at least 7 days since the last rotation (while
551 ignoring the exact time). The weekday intepretation is follow‐
552 ing: 0 means Sunday, 1 means Monday, ..., 6 means Saturday; the
553 special value 7 means each 7 days, irrespectively of weekday.
554 Defaults to 0 if the weekday argument is omitted.
555 yearly Log files are rotated if the current year is not the same as the
558 last rotation.
559
562 /var/lib/logrotate/logrotate.status
563 Default state file.
564 /etc/logrotate.conf Configuration options.
565
567 gzip(1)
568 <https://github.com/logrotate/logrotate>
570
572 Erik Troan, Preston Brown, Jan Kaluza.
573 <https://github.com/logrotate/logrotate>
575Linux Wed Nov 5 2002 LOGROTATE(8)