17.3. Locating Log Files

Most log files are located in the /var/log/ directory. Some applications such as httpd and samba have a directory within /var/log/ for their log files.

You may notice multiple files in the /var/log/ directory with numbers after them (e.g.: cron-20100906). These numbers represent a timestamp that has been added to a rotated log file. Log files are rotated so their file sizes do not become too large. The logrotate package contains a cron task that automatically rotates log files according to the /etc/logrotate.conf configuration file and the configuration files in the /etc/logrotate.d/ directory.

17.3.1. Configuring logrotate

The following is a sample /etc/logrotate.conf configuration file:

# rotate log files weekly
weekly
# keep 4 weeks worth of backlogs
rotate 4
# uncomment this if you want your log files compressed
compress

All of the lines in the sample configuration file define global options that apply to every log file. In our example, log files are rotated weekly, rotated log files are kept for the duration of 4 weeks, and all rotated log files are compressed by gzip into the .gz format. Any lines that begin with a hash sign (#) are comments and are not processed

You may define configuration options for a specific log file and place it under the global options. However, it is advisable to create a separate configuration file for any specific log file in the /etc/logrotate.d/ directory and define any configuration options there.

The following is an example of a configuration file placed in the /etc/logrotate.d/ directory:

/var/log/messages {
    rotate 5
    weekly
    postrotate
    /usr/bin/killall -HUP syslogd
    endscript
}

The configuration options in this file are specific for the /var/log/messages log file only. The settings specified here override the global settings where possible. Thus the rotated /var/log/messages log file will be kept for five weeks instead of four weeks as was defined in the global options.

The following is a list of some of the directives you can specify in your logrotate configuration file:

weekly — Specifies the rotation of log files on a weekly basis. Similar directives include:
- daily
- monthly
- yearly
compress — Enables compression of rotated log files. Similar directives include:
- nocompress
- compresscmd — Specifies the command to be used for compressing.
- uncompresscmd
- compressext — Specifies what extension is to be used for compressing.
- compressoptions — Lets you specify any options that may be passed to the used compression program.
- delaycompress — Postpones the compression of log files to the next rotation of log files.
rotate <INTEGER> — Specifies the number of rotations a log file undergoes before it is removed or mailed to a specific address. If the value 0 is specified, old log files are removed instead of rotated.
mail <ADDRESS> — This option enables mailing of log files that have been rotated as many times as is defined by the rotate directive to the specified address. Similar directives include:
- nomail
- mailfirst — Specifies that the just-rotated log files are to be mailed, instead of the about-to-expire log files.
- maillast — Specifies that the just-rotated log files are to be mailed, instead of the about-to-expire log files. This is the default option when mail is enabled.

For the full list of directives and various configuration options, refer to the logrotate man page (man logrotate).