This tutorial, we'll learn the advanced Logrotate configuration on Ubuntu 24.04.
Log management is crucial for maintaining system performance and ensuring that your logs do not consume too much disk space. On Ubuntu, logrotate is a powerful tool that automatically manages log files by rotating, compressing, and deleting old logs. In this tutorial, we will cover the steps to configure logrotate for efficient log management on an Ubuntu system.
For those who require more granular control over log rotation, Logrotate offers advanced configuration options. These can be particularly useful for managing large-scale environments, ensuring optimal performance, and handling specific application requirements. Below, we'll delve into some of the advanced features and configurations of Logrotate.
Prerequisites
- Ubuntu system (Ubuntu 20.04 or later) dedicated server or KVM VPS.
- Basic knowledge of Logrotate and log management.
- Access to a user account with sudo privileges.
1. Understanding Logrotate Directives
Before diving into advanced configurations, it's important to understand some key directives that Logrotate offers:
- maxsize [size]: Rotates the log if it grows larger than the specified size (e.g., maxsize 100M).
- minsize [size]: Only rotates the log if it reaches a minimum size (e.g., minsize 1M).
- dateext: Appends the current date to the filename when rotating, making it easier to identify logs.
- olddir [directory]: Moves old logs to a specified directory after rotation.
- prerotate/postrotate: Runs scripts before or after log rotation, allowing for custom actions like notifying services.
2. Configuring Logrotate with Date-based Log Naming
Using the dateext option, Logrotate can append dates to rotated log files, making it easier to track logs over time.
Edit the configuration file for a specific application, such as Nginx:
sudo nano /etc/logrotate.d/nginx
Add the dateext option:
/var/log/nginx/*.log {
daily
dateext
dateformat -%Y-%m-%d
rotate 7
compress
delaycompress
missingok
notifempty
create 0640 www-data adm
sharedscripts
postrotate
[ -f /var/run/nginx.pid ] && kill -USR1 `cat /var/run/nginx.pid`
endscript
}
- dateext: Adds a date to the rotated log file (e.g., access.log-2024-08-13).
- dateformat: Customizes the date format; here, it’s set to YYYY-MM-DD.
3. Using Size-based Log Rotation
For applications that generate a significant amount of logs, rotating based on file size can be more effective than time-based rotation.
Edit the configuration file for the application:
sudo nano /etc/logrotate.d/app
Implement size-based rotation:
/var/log/app/*.log {
size 100M
rotate 10
compress
delaycompress
missingok
notifempty
create 0640 appuser appgroup
sharedscripts
postrotate
systemctl restart app
endscript
}
- size 100M: Rotates the log when it exceeds 100MB.
- rotate 10: Keeps the last 10 rotated logs.
4. Handling Log Rotation Across Multiple Servers
In a distributed environment, logs might be spread across multiple servers. Using the copytruncate option can help manage logs without disrupting services.
Configure Logrotate with copytruncate:
sudo nano /etc/logrotate.d/multi-server-app
Add the copytruncate option:
/var/log/multi-server-app/*.log {
daily
size 200M
rotate 5
compress
copytruncate
missingok
notifempty
create 0640 appuser appgroup
sharedscripts
postrotate
ssh user@other-server 'sudo systemctl restart app'
endscript
}
- copytruncate: Copies the log file and then truncates the original. This is useful when the application can't close the log file during rotation.
- postrotate with SSH: Restarts the service on another server after rotation.
5. Custom Scripts in Logrotate
Custom scripts can be executed before or after log rotation to perform actions such as notifying administrators or backing up logs to a remote server.
Edit the configuration file:
sudo nano /etc/logrotate.d/custom-scripts
Add custom scripts:
/var/log/custom-app/*.log {
weekly
rotate 4
compress
missingok
notifempty
create 0640 customuser customgroup
prerotate
# Notify admin before rotation
echo "Log rotation starting for custom-app logs" | mail -s "Logrotate Notice" admin@example.com
endscript
postrotate
# Backup logs to a remote server
rsync -av /var/log/custom-app/*.log remoteuser@remote-server:/backup/logs/
endscript
}
- prerotate/endscript: Runs commands before the rotation begins.
- postrotate/endscript: Executes commands after the rotation is completed.
6. Rotating Logs Based on Age and Size Combined
You might want to rotate logs based on both age and size, ensuring that logs are rotated either after a certain period or when they reach a specific size.
Edit the configuration file:
sudo nano /etc/logrotate.d/combined
Combine age and size rotation:
/var/log/combined-app/*.log {
daily
size 50M
rotate 7
compress
missingok
notifempty
create 0640 combineduser combinedgroup
sharedscripts
postrotate
systemctl reload combined-app
endscript
}
The logs will be rotated daily or when they reach 50MB, whichever comes first.
7. Configuring Logrotate for Applications That Log to Standard Output
Applications that log to standard output (e.g., Docker containers) can be managed using logrotate by redirecting logs.
Create a custom log file for the application:
sudo mkdir -p /var/log/custom-app
Redirect standard output to a log file:
custom-app > /var/log/custom-app/output.log 2>&1 &
Configure Logrotate:
sudo nano /etc/logrotate.d/custom-app
Add the following configuration:
/var/log/custom-app/output.log {
daily
rotate 10
compress
delaycompress
copytruncate
missingok
notifempty
postrotate
systemctl restart custom-app
endscript
}
Conclusion
By leveraging advanced Logrotate configurations, you can efficiently manage logs in various scenarios, from handling large-scale environments to integrating custom scripts and managing logs across multiple servers. Tailoring Logrotate to your specific needs ensures that your logs are maintained effectively, avoiding disk space issues and ensuring that critical log information is always available when needed.
