Linux Security Cookbook

9.30. Rotating Log Files

Problem

You want to control and organize your ever-growing log files.

Solution

Use logrotate, a program to compress and/or delete log files automatically when they are sufficiently old, perhaps after they have been stashed away on tape backups.

Add entries to /etc/logrotate.d/syslog, e.g.:

               /etc/logrotate.d/syslog:
/var/log/local0 /var/log/local1 ...others... {
        sharedscripts
        postrotate
                /bin/kill -HUP `cat /var/run/syslogd.pid`
        endscript
}

Discussion

Log files should be rotated so they won’t grow indefinitely. Our recipe shows a simple configuration that can be used with logrotate to do this automatically. After the files are shuffled around, the postrotate script sends a signal to the system logger to reopen the log files, and the sharedscripts directive ensures that this is done only once, for all of the log files.

You can add a separate configuration file (with any name) in the /etc/logrotate.d directory, as an alternative to editing the /etc/logrotate.d/syslog file. Separate entries can be used to tune the default behavior of logrotate, which is described by /etc/logrotate.conf, e.g., to rotate some log files more frequently.

See Also

logrotate(8), syslogd(8).