1LOGROTATE(8) System Administrator's Manual LOGROTATE(8)
2
6 logrotate - rotates, compresses, and mails system logs
7
9 logrotate [-dv] [-f|--force] [-s|--state file] config_file ..
10
12 logrotate is designed to ease administration of systems that generate
13 large numbers of log files. It allows automatic rotation, compression,
14 removal, and mailing of log files. Each log file may be handled daily,
15 weekly, monthly, or when it grows too large.
16 Normally, logrotate is run as a daily cron job. It will not modify a
18 log multiple times in one day unless the criterium for that log is
19 based on the log's size and logrotate is being run multiple times each
20 day, or unless the -f or -force option is used.
21 Any number of config files may be given on the command line. Later con‐
23 fig files may override the options given in earlier files, so the order
24 in which the logrotate config files are listed is important. Normally,
25 a single config file which includes any other config files which are
26 needed should be used. See below for more information on how to use
27 the include directive to accomplish this. If a directory is given on
28 the command line, every file in that directory is used as a config
29 file.
30 If no command line arguments are given, logrotate will print version
32 and copyright information, along with a short usage summary. If any
33 errors occur while rotating logs, logrotate will exit with non-zero
34 status.
35
38 -d Turns on debug mode and implies -v. In debug mode, no changes
39 will be made to the logs or to the logrotate state file.
40 -f, --force
43 Tells logrotate to force the rotation, even if it doesn't think
44 this is necessary. Sometimes this is useful after adding new
45 entries to a logrotate config file, or if old log files have
46 been removed by hand, as the new files will be created, and log‐
47 ging will continue correctly.
48 -m, --mail <command>
51 Tells logrotate which command to use when mailing logs. This
52 command should accept two arguments: 1) the subject of the mes‐
53 sage, and 2) the recipient. The command must then read a message
54 on standard input and mail it to the recipient. The default mail
55 command is /bin/mail -s.
56 -s, --state <statefile>
59 Tells logrotate to use an alternate state file. This is useful
60 if logrotate is being run as a different user for various sets
61 of log files. The default state file is /var/lib/logrotate.sta‐
62 tus.
63 --usage
66 Prints a short usage message.
67 -v, --verbose
70 Turns on verbose mode.
71
74 logrotate reads everything about the log files it should be handling
75 from the series of configuration files specified on the command line.
76 Each configuration file can set global options (local definitions over‐
77 ride global ones, and later definitions override earlier ones) and
78 specify logfiles to rotate. A simple configuration file looks like
79 this:
80 # sample logrotate configuration file
82 compress
83 /var/log/messages {
85 rotate 5
86 weekly
87 postrotate
88 /usr/bin/killall -HUP syslogd
89 endscript
90 }
91 "/var/log/httpd/access.log" /var/log/httpd/error.log {
93 rotate 5
94 mail www@my.org
95 size 100k
96 sharedscripts
97 postrotate
98 /usr/bin/killall -HUP httpd
99 endscript
100 }
101 /var/log/news/* {
103 monthly
104 rotate 2
105 olddir /var/log/news/old
106 missingok
107 postrotate
108 kill -HUP `cat /var/run/inn.pid`
109 endscript
110 nocompress
111 }
112 The first few lines set global options; in the example, logs are com‐
115 pressed after they are rotated. Note that comments may appear anywhere
116 in the config file as long as the first non-whitespace character on the
117 line is a #.
118 The next section of the config files defined how to handle the log file
120 /var/log/messages. The log will go through five weekly rotations before
121 being removed. After the log file has been rotated (but before the old
122 version of the log has been compressed), the command /sbin/killall -HUP
123 syslogd will be executed.
124 The next section defines the parameters for both
126 /var/log/httpd/access.log and /var/log/httpd/error.log. They are
127 rotated whenever it grows over 100k in size, and the old logs files are
128 mailed (uncompressed) to www@my.org after going through 5 rotations,
129 rather than being removed. The sharedscripts means that the postrotate
130 script will only be run once (after the old logs have been compressed),
131 not once for each log which is rotated. Note that the double quotes
132 around the first filename at the beginning of this section allows
133 logrotate to rotate logs with spaces in the name. Normal shell quoting
134 rules apply, with ', ", and \ characters supported.
135 The last section defines the parameters for all of the files in
137 /var/log/news. Each file is rotated on a monthly basis. This is con‐
138 sidered a single rotation directive and if errors occur for more than
139 one file, the log files are not compressed.
140 Please use wildcards with caution. If you specify *, logrotate will
142 rotate all files, including previously rotated ones. A way around this
143 is to use the olddir directive or a more exact wildcard (such as
144 *.log).
145 Here is more information on the directives which may be included in a
147 logrotate configuration file:
148 compress
151 Old versions of log files are compressed with gzip(1) by
152 default. See also nocompress.
153 compresscmd
156 Specifies which command to use to compress log files. The
157 default is gzip. See also compress.
158 uncompresscmd
161 Specifies which command to use to uncompress log files. The
162 default is gunzip.
163 compressext
166 Specifies which extension to use on compressed logfiles, if com‐
167 pression is enabled. The default follows that of the configured
168 compression command.
169 compressoptions
172 Command line options may be passed to the compression program,
173 if one is in use. The default, for gzip(1), is "-9" (maximum
174 compression).
175 copy Make a copy of the log file, but don't change the original at
178 all. This option can be used, for instance, to make a snapshot
179 of the current log file, or when some other utility needs to
180 truncate or parse the file. When this option is used, the cre‐
181 ate option will have no effect, as the old log file stays in
182 place.
183 copytruncate
186 Truncate the original log file in place after creating a copy,
187 instead of moving the old log file and optionally creating a new
188 one. It can be used when some program cannot be told to close
189 its logfile and thus might continue writing (appending) to the
190 previous log file forever. Note that there is a very small time
191 slice between copying the file and truncating it, so some log‐
192 ging data might be lost. When this option is used, the create
193 option will have no effect, as the old log file stays in place.
194 create mode owner group
197 Immediately after rotation (before the postrotate script is run)
198 the log file is created (with the same name as the log file just
199 rotated). mode specifies the mode for the log file in octal
200 (the same as chmod(2)), owner specifies the user name who will
201 own the log file, and group specifies the group the log file
202 will belong to. Any of the log file attributes may be omitted,
203 in which case those attributes for the new file will use the
204 same values as the original log file for the omitted attributes.
205 This option can be disabled using the nocreate option.
206 daily Log files are rotated every day.
209 dateext
212 Archive old versions of log files adding a daily extension like
213 YYYYMMDD instead of simply adding a number. The extension may be
214 configured using the dateformat option.
215 dateformat format_string
218 Specify the extension for dateext using the notation similar to
219 strftime(3) function. Only %Y %m %d and %s specifiers are
220 allowed. The default value is -%Y%m%d. Note that also the char‐
221 acter separating log name from the extension is part of the
222 dateformat string. The system clock must be set past Sep 9th
223 2001 for %s to work correctly. Note that the datestamps gener‐
224 ated by this format must be lexically sortable (i.e., first the
225 year, then the month then the day. e.g., 2001/12/01 is ok, but
226 01/12/2001 is not, since 01/11/2002 would sort lower while it is
227 later). This is because when using the rotate option, logrotate
228 sorts all rotated filenames to find out which logfiles are older
229 and should be removed.
230 delaycompress
233 Postpone compression of the previous log file to the next rota‐
234 tion cycle. This only has effect when used in combination with
235 compress. It can be used when some program cannot be told to
236 close its logfile and thus might continue writing to the previ‐
237 ous log file for some time.
238 extension ext
241 Log files with ext extension can keep it after the rotation. If
242 compression is used, the compression extension (normally .gz)
243 appears after ext. For example you have a logfile named
244 mylog.foo and want to rotate it to mylog.1.foo.gz instead of
245 mylog.foo.1.gz.
246 ifempty
249 Rotate the log file even if it is empty, overriding the
250 notifempty option (ifempty is the default).
251 include file_or_directory
254 Reads the file given as an argument as if it was included inline
255 where the include directive appears. If a directory is given,
256 most of the files in that directory are read in alphabetic order
257 before processing of the including file continues. The only
258 files which are ignored are files which are not regular files
259 (such as directories and named pipes) and files whose names end
260 with one of the taboo extensions, as specified by the tabooext
261 directive.
262 mail address
265 When a log is rotated out-of-existence, it is mailed to address.
266 If no mail should be generated by a particular log, the nomail
267 directive may be used.
268 mailfirst
271 When using the mail command, mail the just-rotated file, instead
272 of the about-to-expire file.
273 maillast
276 When using the mail command, mail the about-to-expire file,
277 instead of the just-rotated file (this is the default).
278 maxage count
281 Remove rotated logs older than <count> days. The age is only
282 checked if the logfile is to be rotated. The files are mailed to
283 the configured address if maillast and mail are configured.
284 minsize size
287 Log files are rotated when they grow bigger than size bytes, but
288 not before the additionally specified time interval (daily,
289 weekly, monthly, or yearly). The related size option is similar
290 except that it is mutually exclusive with the time interval
291 options, and it causes log files to be rotated without regard
292 for the last rotation time. When minsize is used, both the size
293 and timestamp of a log file are considered.
294 missingok
297 If the log file is missing, go on to the next one without issu‐
298 ing an error message. See also nomissingok.
299 monthly
302 Log files are rotated the first time logrotate is run in a month
303 (this is normally on the first day of the month).
304 nocompress
307 Old versions of log files are not compressed. See also compress.
308 nocopy Do not copy the original log file and leave it in place. (this
311 overrides the copy option).
312 nocopytruncate
315 Do not truncate the original log file in place after creating a
316 copy (this overrides the copytruncate option).
317 nocreate
320 New log files are not created (this overrides the create
321 option).
322 nodelaycompress
325 Do not postpone compression of the previous log file to the next
326 rotation cycle (this overrides the delaycompress option).
327 nodateext
330 Do not archive old versions of log files with date extension
331 (this overrides the dateext option).
332 nomail Don't mail old log files to any address.
335 nomissingok
338 If a log file does not exist, issue an error. This is the
339 default.
340 noolddir
343 Logs are rotated in the same directory the log normally resides
344 in (this overrides the olddir option).
345 nosharedscripts
348 Run prerotate and postrotate scripts for every log file which is
349 rotated (this is the default, and overrides the sharedscripts
350 option). The absolute path to the log file is passed as first
351 argument to the script. If the scripts exit with error, the
352 remaining actions will not be executed for the affected log
353 only.
354 noshred
357 Do not use shred when deleting old log files. See also shred.
358 notifempty
361 Do not rotate the log if it is empty (this overrides the ifempty
362 option).
363 olddir directory
366 Logs are moved into directory for rotation. The directory must
367 be on the same physical device as the log file being rotated,
368 and is assumed to be relative to the directory holding the log
369 file unless an absolute path name is specified. When this option
370 is used all old versions of the log end up in directory. This
371 option may be overridden by the noolddir option.
372 postrotate/endscript
375 The lines between postrotate and endscript (both of which must
376 appear on lines by themselves) are executed (using /bin/sh)
377 after the log file is rotated. These directives may only appear
378 inside a log file definition. Normally, the absolute path to the
379 log file is passed as first argument to the script. If shared‐
380 scripts is specified, whole pattern is passed to the script.
381 See also prerotate. See sharedscripts and nosharedscripts for
382 error handling.
383 prerotate/endscript
386 The lines between prerotate and endscript (both of which must
387 appear on lines by themselves) are executed (using /bin/sh)
388 before the log file is rotated and only if the log will actually
389 be rotated. These directives may only appear inside a log file
390 definition. Normally, the absolute path to the log file is
391 passed as first argument to the script. If sharedscripts is
392 specified, whole pattern is passed to the script. See also
393 postrotate. See sharedscripts and nosharedscripts for error
394 handling.
395 firstaction/endscript
398 The lines between firstaction and endscript (both of which must
399 appear on lines by themselves) are executed (using /bin/sh) once
400 before all log files that match the wildcarded pattern are
401 rotated, before prerotate script is run and only if at least one
402 log will actually be rotated. These directives may only appear
403 inside a log file definition. Whole pattern is passed to the
404 script as first argument. If the script exits with error, no
405 further processing is done. See also lastaction.
406 lastaction/endscript
409 The lines between lastaction and endscript (both of which must
410 appear on lines by themselves) are executed (using /bin/sh) once
411 after all log files that match the wildcarded pattern are
412 rotated, after postrotate script is run and only if at least one
413 log is rotated. These directives may only appear inside a log
414 file definition. Whole pattern is passed to the script as first
415 argument. If the script exits with error, just an error message
416 is shown (as this is the last action). See also firstaction.
417 rotate count
420 Log files are rotated count times before being removed or mailed
421 to the address specified in a mail directive. If count is 0, old
422 versions are removed rather than rotated.
423 size size
426 Log files are rotated when they grow bigger than size bytes. If
427 size is followed by k, the size is assumed to be in kilobytes.
428 If the M is used, the size is in megabytes, and if G is used,
429 the size is in gigabytes. So size 100, size 100k, size 100M and
430 size 100Gare all valid.
431 sharedscripts
434 Normally, prerotate and postrotate scripts are run for each log
435 which is rotated and the absolute path to the log file is passed
436 as first argument to the script. That means a single script may
437 be run multiple times for log file entries which match multiple
438 files (such as the /var/log/news/* example). If sharedscripts is
439 specified, the scripts are only run once, no matter how many
440 logs match the wildcarded pattern, and whole pattern is passed
441 to them. However, if none of the logs in the pattern require
442 rotating, the scripts will not be run at all. If the scripts
443 exit with error, the remaining actions will not be executed for
444 any logs. This option overrides the nosharedscripts option and
445 implies create option.
446 shred Delete log files using shred -u instead of unlink(). This
449 should ensure that logs are not readable after their scheduled
450 deletion; this is off by default. See also noshred.
451 shredcycles count
454 Asks GNU shred(1) to overwite log files count times before dele‐
455 tion. Without this option, shred's default will be used.
456 start count
459 This is the number to use as the base for rotation. For example,
460 if you specify 0, the logs will be created with a .0 extension
461 as they are rotated from the original log files. If you specify
462 9, log files will be created with a .9, skipping 0-8. Files
463 will still be rotated the number of times specified with the
464 count directive.
465 tabooext [+] list
468 The current taboo extension list is changed (see the include
469 directive for information on the taboo extensions). If a + pre‐
470 cedes the list of extensions, the current taboo extension list
471 is augmented, otherwise it is replaced. At startup, the taboo
472 extension list contains .rpmsave, .rpmorig, ~, .disabled, .dpkg-
473 old, .dpkg-dist, .dpkg-new, .cfsaved, .ucf-old, .ucf-dist, .ucf-
474 new, .rpmnew, .swp, .cfsaved, .rhn-cfg-tmp-*
475 weekly Log files are rotated if the current weekday is less than the
478 weekday of the last rotation or if more than a week has passed
479 since the last rotation. This is normally the same as rotating
480 logs on the first day of the week, but it works better if logro‐
481 tate is not run every night.
482 yearly Log files are rotated if the current year is not the same as the
485 last rotation.
486
489 /var/lib/logrotate.status Default state file.
490 /etc/logrotate.conf Configuration options.
491
493 gzip(1)
494
496 Erik Troan <ewt@redhat.com>
497 Preston Brown <pbrown@redhat.com>
498Linux Wed Nov 5 2002 LOGROTATE(8)