How to Use the Ubuntu logrotate Utility to Manage Log File Sizes

Every service running on an Ubuntu server—from the Apache web server to the SSH daemon—generates log files. Over time, these log files can grow to massive sizes, eventually consuming all available disk space and causing the server to crash. To prevent this, Linux relies on the logrotate utility. Logrotate automatically archives, compresses, and deletes old log files based on a predefined schedule, ensuring your logs remain manageable.

How Logrotate Works

Logrotate is executed daily by a cron job (specifically, the script located at /etc/cron.daily/logrotate). When it runs, it reads its main configuration file (/etc/logrotate.conf) and any application-specific configuration files located in the /etc/logrotate.d/ directory.

Anatomy of a Logrotate Configuration

Let’s examine a typical configuration file. If you install Apache, it automatically creates a file at /etc/logrotate.d/apache2. Its contents look something like this:

/var/log/apache2/*.log {
    daily
    missingok
    rotate 14
    compress
    delaycompress
    notifempty
    create 640 root adm
    sharedscripts
    postrotate
        if /etc/init.d/apache2 status > /dev/null ; then \
            /etc/init.d/apache2 reload > /dev/null; \
        fi;
    endscript
}

Understanding the Directives

Here is what each line in the block above actually does:

• /var/log/apache2/*.log: The target files. This applies the rules to any file ending in .log in the Apache directory.
• daily: Rotate the logs every day. (Other options are weekly, monthly, or size 100M).
• missingok: Do not output an error message if the log file is missing.
• rotate 14: Keep exactly 14 archived logs. When the 15th log is created, the oldest one is permanently deleted.
• compress: Compress the archived logs using gzip to save disk space.
• delaycompress: Do not compress yesterday’s log file immediately. Wait until the next rotation cycle. This is useful for programs that might still be trying to write to the old log file shortly after rotation.
• notifempty: Do not rotate the log file if nothing was written to it.
• create 640 root adm: Immediately after rotating, create a new, empty log file with permissions 640, owned by the user ‘root’ and the group ‘adm’.
• postrotate / endscript: Any shell commands placed between these tags are executed immediately after the log is rotated. In this case, it tells Apache to reload its configuration so it knows to start writing to the newly created file instead of the old one.

Testing a Configuration

If you create a custom logrotate script for your own application, you can test it without waiting for the daily cron job. Use the -d (debug) flag to simulate a run. This will output exactly what logrotate would do without actually modifying any files:

sudo logrotate -d /etc/logrotate.d/myapp

To force an immediate rotation (useful if a log file has unexpectedly grown out of control), use the -f (force) flag:

sudo logrotate -f /etc/logrotate.d/myapp

By understanding and customizing logrotate configurations, you ensure that your Ubuntu server maintains a detailed history of events without ever running out of critical storage space.