découvrez comment maîtriser l'automatisation de la rotation des journaux sous linux avec logrotate pour optimiser la gestion de vos fichiers logs et améliorer la performance de vos systèmes.

Linux: Master log rotation automation with logrotate

by

Understanding the Importance of Log Rotation in Linux with logrotate

Log file management is a crucial component of Linux system administration. These logs record a multitude of system events, ranging from service errors to unauthorized access attempts. Without proper management, these files can quickly grow and saturate disk space, degrading performance and making system monitoring difficult or even impossible. This is where logrotate comes in, an essential tool that automates log rotation. By leveraging logrotate, it’s possible to schedule log rotation frequency, compress older files, delete them after a certain number of cycles, and execute associated bash scripts. This addresses common server maintenance needs by ensuring efficient and sustainable log file management, particularly in critical infrastructure environments such as web servers or heavily used network services. To take a concrete example, imagine a company hosting an Apache server that receives thousands of visits per day. Without effective log management, the log files accessible in /var/log/apache2/ would quickly grow, making them tedious to consult and taking up a significant amount of hard drive space. Implementing logrotate will allow these files to be archived and compressed at appropriate intervals, while maintaining a controlled history. Here is a list of the consequences of not having an automated rotation policy: Rapid saturation of server storage volumes.Degraded service response times due to log file overload. Increased difficulty in searching for and analyzing events within excessively large files.Increased risk of unavailability or loss of critical data due to disk capacity overflow.

The solution is therefore obvious: mastering logrotate to automatically schedule log rotation, with the aim of optimizing both server performance and ease of administration. Advanced logrotate features for fine-grained Linux log managementBeyond its basic function, the logrotate software introduces a range of possibilities for customizing rotation behavior to adapt to the specific characteristics of log files and system constraints. Here are the main features to know: Automatic rotation: logrotate archives old log files at scheduled intervals (daily, weekly, monthly), then creates a new blank file accessible to the relevant service.

Compression of archived files: To save disk space, archived logs are compressed in gzip format, using the `compress` option. It is also possible to defer this operation with `delaycompress` to avoid immediate compression and conflicts with processes that might continue writing to the file. Retention Management: You can configure the maximum number of archived log versions using `rotate n` to prevent excessive accumulation, a key element for optimizing server maintenance. Execution of Custom Scripts before (`prerotate`) or after (`postrotate`) each rotation: This allows you to restart or reload a service to incorporate the new files, or to automate additional actions. Secure Permission Management: The `create mode owner group` directive ensures that files recreated after rotation have the correct permissions to prevent access issues.

Missing File Tolerance: Thanks to the `missingok` option.

  • The absence of a log file does not prevent the rotation from running.
  • Size limit: A rotation can be started as soon as the file reaches a certain size, for even finer control.

These options are stored in centralized configuration files, located in the `/etc/logrotate.d/` directory and the `/etc/logrotate.conf` global file, which facilitates the cron scheduling of automated tasks without human intervention. To illustrate, let’s take the rotation configuration file for Chrony, a clock synchronization daemon: `/var/log/chrony/*.log { missingoknocreate

sharedscripts

postrotate /usr/bin/chronyc cyclelogs > /dev/null 2>&1 ||` true endscript

}

  • Note the following best practices: missingok avoids errors if the file no longer exists nocreate
  • prevents the automatic creation of a new file, which is delegated to Chrony itself Running a script in the postrotatesection, which cleanly reloads the logs The level of customization offered by logrotate makes the tool suitable for both classic server environments and complex infrastructures requiring precise control of log files. Installation and verification of logrotate on major Linux distributions
  • Most modern Linux distributions provide logrotate by default or via their official repositories, which greatly simplifies implementation. The first step is to check its presence and current version on the machine: sudo logrotate –version : command displaying the version, and some parameters such as default commands associated with compression and state paths.
  • On Debian, Ubuntu, and derivatives, the installation command is: `sudo apt update && sudo apt install logrotate -y` On RHEL, Rocky Linux, CentOS, or Fedora, the procedure follows the syntax: `sudo yum install logrotate`After installation, it is recommended to check and adjust the configuration in/etc/logrotate.confand the files under/etc/logrotate.d/
  • . Running rotation simulations is a valuable step: sudo logrotate -d /etc/logrotate.conf : tests the configuration without applying the rotation.
  • sudo logrotate -f /etc/logrotate.conf : forces immediate rotation, useful for validating your settings.This validation step prevents errors in production. You must also ensure that the logrotate cron job is installed, usually located in
  • /etc/cron.daily/logrotate . It guarantees the regular execution of rotations without requiring intervention.

Here is an overview of the points to check for a successful installation: Presence of the logrotate command and the correct version (often >= 3.22). Existence and permissions of global and system-specific configuration files. Functional cron script that runs daily. Rotation tests successfully completed in debug mode. https://www.youtube.com/watch?v=Rkd7pOYrMMs

Finally, a solid understanding of the installation process is essential for achieving a configuration tailored to your specific needs, which will be covered in the next section.

Detailed steps to configure logrotate on a Linux service
    Configuring logrotate on a specific service provides crucial control for fine-tuning your configuration files and adjusting rotation based on log volume and criticality.
    The files dedicated to each service are located in /etc/logrotate.d/. You can view their contents with: `sudo ls -l /etc/logrotate.d/`
    They often contain the configuration for common services such as apt, rsyslog, wtmp, and chrony. Let's take the example of a configuration for Apache2, a very popular web server. To manage the rotation in
    /var/log/apache2/
        
    create a file
/etc/logrotate.d/apache2

with this content:

  • /var/log/apache2/*.log { daily missingok
  • rotate 31 compress
  • delaycompress notifemptycreate 640 root adm

sharedscripts

postrotate

/usr/sbin/apache2ctl gracefully > /dev/null 2>/dev/null || true endscript }

  • daily : Daily rotation, suitable for high web traffic.

missingok

: Continues without error if a file is missing.

rotate 31

: Keeps a full month of compressed logs.

compress and delaycompress : Delayed compression to avoid conflicts with files in use.notifempty

  • : No rotation if the log is empty. create 640 root adm
  • : Automatically creates a new file with the correct permissions and groups.

sharedscripts and postrotate : Clean restart of the Apache service so it can take control of the new log file. Syntax checking and simulation of this configuration are necessary to avoid any interruption:`sudo logrotate -d /etc/logrotate.d/apache2`

for a test without execution.

  • `sudo logrotate -f /etc/logrotate.d/apache2` to immediately apply the rotation.
  • This example can be applied to any other service that generates large logs, such as Nginx, Traefik, or database solutions, thus facilitating the securing and optimization of the environment.
  • To go further, combining scheduled rotations with complementary tools such as Bash scripts enabled by the `prerotate` and `postrotate` directives undoubtedly opens up extensive possibilities for seamless automation. https://www.youtube.com/watch?v=lrcQ6wT-VYs
Proper log rotation planning ensures an ideal balance between retaining logs for system monitoring and saving disk space, while preserving service availability and integrity.

Optimizing log rotation with cron scheduling and custom bash scripts

The logrotate tool typically works with a cron job configured by default on most Linux distributions. It is typically located in

/etc/cron.daily/logrotate , which means that the rotation is triggered automatically every day. This automation is essential for production systems to ensure rigorous server maintenance without manual intervention. To change the execution frequency, for example, switching from daily to weekly rotation, you can create a custom cron job or adjust the configuration in the main logrotate file (/etc/logrotate.conf) by simply changing the associated option. Example modifications: Replacing the weekly or daily directive as needed.

Increasing or decreasing the rotate value to keep more or fewer log files. Adding or removing compression via compress and delaycompress.When services require specific processing after rotation, you can use bash scripts embedded in the prerotate or postrotate directives. These scripts allow you, for example, to cleanly restart a process or clear a log cache.

Here are some best practices for strengthening automated management: Ensure that scripts do not cause errors: insert conditional clauses and error redirections (`true`) to maintain stability.Test scripts independently before integration. Document changes to facilitate future maintenance. Monitor cron error messages using `sudo journalctl -u cron` to identify any anomalies.

The combined management of cron scheduling and custom scripts offers significant flexibility to meet specific requirements for backing up and rotating log files.
        To learn more about scheduling tasks under Linux, consult this resource dedicated to cron scheduling.
        Furthermore, integration with other systems, such as automated SMS notification transmission on a Raspberry Pi environment, can be implemented using appropriate scripting as presented on
        Raspisms Raspberry Pi SMS
        
        .