Lock down your logfiles with logrotate
How Very Apt
As you might suspect, residing inside the logrotate profile /etc/logrotate.d/apt/
are the Apt package manager config files. Dpkg also has its own profiles with quite different config options (e.g., look inside /etc/logrotate.d
).
In Figure 2, you can see that two otherwise relatively obscure logfiles relating to the Apt package manager are rotated and compressed. Moreover, no errors are generated if a log isn't present to rotate or is empty (notifempty
).
It's worth mentioning that the good old hash symbol will let you put comments into the profiles for each application, which can be useful if you've tried something new with your logs, left it running for a few weeks, and then returned to revert those changes. In the case of both term.log
and history.log
, the reliable logrotate will dutifully create and then rotate 12 monthly logfiles before deleting the oldest.
Clearly, you can easily deploy such profiles for other applications. Simplicity is always the way to fix complex problems in my book, and logrotate certainly doesn't fail to impress with its straightforward configuration options.
Making a Move
Now I want to look at profiles for other packages, some of which are popular and explained in the logrotate man page [1] if further information is needed. For clarity, I want to extol the simplicity of tidying up after changing the state of a logfile.
If you've ever tried manually shuffling logfiles and forgotten, or not realized, that you need to stop and start the service relating to that logfile after doing so, then you wouldn't be the first admin be caught out. That embarrassing moment when you return to your well-needed logfile a few days later to discover it is empty is never welcome. Rest assured that it's an easy mistake to make in a hectic environment.
A safe rule of thumb is that when an application starts up, it first needs to have write permission to the logfile directory (in the case of the two Apt examples, this directory would be /var/log/apt
and not the more common /var/log
). Second, it needs write permissions for the logfile in question. If the pertinent logfile is suddenly and forcefully renamed or moved to another location, then the application can simply appear to be running perfectly normally but in fact not be logging at all.
The examples in Figures 3 and 4 show two quite different restart options, neither of which uses the now common service <package> restart
syntax or the old faithful /etc/init.d/<package> restart
format. In the rsyslog example, you'll see that this example refers the Ubuntu-style [start
|stop
|restart
|reload
] syntax, where the action can be written without placing service
at the front.
Parameters Aplenty
The eagle-eyed among you will have spotted in Figures 3 and 4 the postrotate
parameters, under which the restart commands are nested. As you can probably guess, postrotate
succinctly says to logrotate and, once done, finish by doing the tasks that follow.
A quick word of warning is that although wildcards are supported, you should approach them with caution because a misplaced asterisk will rotate every single file in a directory, breaking some (if not many) functions of varying importance. Although it will be easy to spot what has broken your application after a restart, point logrotate at the wrong place with a misplaced question mark or asterisk, and downtime could be in the cards. However, using *.log
is a convenient and safe approach.
One of the logrotate parameters that always jumps out is the olddir
command. For example, if
olddir /var/log/older/<daemon-name>
is inside the curly brackets of a profile but not nested within other commands and the olddir
directory resides on the same disk as your main log directory, then the super-tidy logrotate will move old logs into this directory. This could mean that in /var/log
you just see your current files instead of a host of backup, older file names, helping clarify what should and should not be considered current. I like this functionality because I'm almost always looking at the newest logfile first before delving further into older logs for trickier issues.
At this juncture, it's worth mentioning /etc/logrotate.conf
, because it contains a few non-standard config options. The sections that catch my eye are shown in Figure 5. wtmp
contains historical data about user logins and logouts, the terminals at which they occur, and other system events like reboots. btmp
only records failed login attempts. The create
lines create new logfiles owned by user root and assign permissions.
« Previous 1 2 3 4 Next »
Buy this article as PDF
(incl. VAT)
Buy Linux Magazine
Direct Download
Read full article as PDF:
Price $2.95
News
-
KaOS 2022.06 Now Available With KDE Plasma 5.25
The newest iteration of KaOS Linux not only adds the latest KDE Plasma desktop but sets LibreOffice as the default.
-
Manjaro 21.3.0 Is Now Available
Manjaro “Ruah” has been released and includes the latest Calamares installer, GNOME 42, and much more.
-
SpiralLinux is a New Linux Distribution Focused on Simplicity
A new Linux distribution, from the creator of GeckoLinux, is a Debian-based operating system with a focus on simplicity and ease of use.
-
HP Dev One Linux Laptop is Now Available for Pre-Order
The System76/HP collaboration Dev One laptop, geared toward developers, is now available for pre-order.
-
NixOS 22.5 Is Now Available
The latest release of NixOS with a much-improved package manager and a user-friendly graphical installer.
-
System76 Teams up with HP to Create the Dev One Laptop
HP and System76 have come together to develop a new laptop, powered by Pop!_OS and aimed toward developers.
-
Titan Linux is a New KDE Linux Based on Debian Stable
Titan Linux is a new Debian-based Linux distribution that features the KDE Plasma desktop with a focus on usability and performance.
-
Danielle Foré Has an Update for elementary OS 7
Now that Ubuntu 22.04 has been released, the team behind elementary OS is preparing for the upcoming 7.0 release.
-
Linux New Media Launches Open Source JobHub
New job website focuses on connecting technical and non-technical professionals with organizations in open source.
-
Ubuntu Cinnamon 22.04 Now Available
Ubuntu Cinnamon 22.04 has been released with all the additions from upstream as well as other features and improvements.