Log Rotations

Log rotations can come out-of-the-box in some Linux systems for things like system logs. For custom logs in your application, you will likely configure it yourself.

Why are log rotations useful? Rotating logs can reduce the disk usage of log files by compressing and rotating them in chunks. Rotations can be set to run with cron jobs, so the timing can be flexible and configurable.

Recently, I was tasked to rotate logs when an application failed due to a full disk. Upon investigation, the disk was full because our app log file had grown to fill the disk. An easy stop-gap was to re-deploy the app. This overwrote the contents on our linux sever at /var/app/, the location in which we stored our app. Afterwards, the app ran fine! But how do we ensure that this doesn’t happen again? The answer is logrotate.

logrotate [-dv] [-f|--force] [-s|--state file] config_file .. (see more info here)

Setting up logrotate

To start, you’ll need a configuration file. This file will define the details of the log rotation, such as the files to rotate and the rotation criteria (file size, schedule, etc). In my case, I was looking for daily log rotations. My config file looked like this:

/var/app/logs/*.log {
    daily // daily rotation
    rotate 2 // only keep 2 rotated files at one time.
    compress // rotated files will be compressed
    copytruncate // copytruncate will move contents in place
    missingok // a missing log file is ok
    notifempty // don't run if the log file is empty
    dateext // with this flag, we can pass in a dateformat, see below.
    dateformat -%Y%m%d
    olddir /var/log/rotated // file path for rotated files
}

To test your configuration file, you can simply run logrotate /path/to/config/file.conf. In your destination folder, you should see the rotated logs.

Next, you need to setup a cron job for this script to run. Linux systems provide a file path to place scripts which need to be run. Depending on the required schedule, your folder will vary. The locations include: /etc/cron.hourly/ and /etc/cron.daily/. For our purposes, we added our logrotate script to the daily folder.

See below for an example bash file which runs our logrotate. FYI: An additional status file can be added. This file helps gain visibility into the last run of each log rotation. Simply pass a file path into the -s argument.

#!/bin/
test -x /usr/sbin/logrotate || exit 0
/usr/sbin/logrotate -s /path/to/status/file.status -f /path/to/config/file.conf

Log rotations are now setup. If schedules need to be changed, the script file can be moved to the appropriate cron folder and the configuration file can be adjusted. Note: if you wish to use a more frequent rotation schedule, you’ll need to add a more unique dateformat (adding %s or %H may help!).