logrotate is a bash script which can rotate log files and multilog log directories and archive them in a central location.
logrotate requires GNU bash, GNU gzip and GNU date.
logrotate rotates log files into an archive. The name of the archived file is based on the date, so the ssh log would be saved to /archives/2003/ssh/2003-01-01.gz, for example.
logrotate handles multilog directories by concatenating all fully processed logs and saving the combined contents.
After rotating each log, logrotate will normally delete it (you can tell it not to) and may optionally touch the file (useful for Solaris syslog, which expects to log to an existing file!) and/or run a script of your choice (useful to send a HUP signal, for example). logrotate can optionally be told to do something before it starts work and/or do something when it has finished.
Edit the logrotate script and set the global variables listed at the top.
Specifies the root for the archived logs.
Commands to be executed before doing anything else.
Example: svc -d /service/mysql
Commands to be executed immediately before exiting.
Example: svc -u /service/mysql
Set this to anything and logrotate will be verbose. You can also use the -v flag when running the script.
Then set the paths to needed tools if necessary. In some cases you may need to set custom paths to the GNU versions of tools.
Path to GNU date.
Path to GNU gzip.
Next you need to define which services are going to be rotated. Edit the logs variable for that. Each entry in logs is just a label and can be named anything you like. For example, you might say:
This would tell logrotate to expect directives defining how to rotate qmail and MySQL logs.
For each entry in the logs line, you must define two variables: path_xxx and files_xxx. The path variable tells logrotate where the logs are stored. Using the qmail example above, you might write
The files variable lists the files (or multilog directories) which should be rotated. You can put wildcards and other shell stuff in here if you want.
files_qmail="send smtpd pop3d"
logrotate uses the path and files variables together to determine what to rotate. Still with the example above, it would rotate /var/log/qmail/send, /var/log/qmail/smtpd and /var/log/qmail/pop3d.
The archived files would be stored in /archives/year/send/year-month-day.gz etc.
There are some optional variables which you can set for each log target.
If this is set, logrotate won't delete files after archiving them. In any case, logrotate will never delete files if the archive operation failed.
If this is set, logrotate will touch files after archiving and (maybe) deleting the originals.
Commands to be run before rotating files.
Example: hup_apache="killall -1 httpd"
If this is set, logrotate will copy files and then operate on the copies. This is not the default because it means using up much more disk space but it is useful to rotate logs from a program which keeps filehandles open but which you don't want to HUP.
Subdirectory of $archive where logs should be be rotated.
qmail logs would now be archived under /archives/year/qmail.
Appended to filename when choosing path for archived log.
qmail logs would now be archived under /archives/year/xxx.log.
Suffix appended when logs are kept (keep_xxx is set). Defaults to .old when unset.